CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
VMware vCenter Server DCERPC Protocol Heap Overflow Remote Code Execution Vulnerability (CVE-2024-38812) Critical Security Advisory
[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, VMware Cloud Foundation versions 4.x and 5.x
[Impact] An unauthenticated remote attacker can trigger a heap overflow via specially crafted DCERPC packets, potentially executing arbitrary code with root privileges
[Mitigation] Immediately apply the official Broadcom security patches (vCenter 8.0 U3b / 7.0 U3s or later) and restrict network access to vCenter management ports
VMware vCenter Server DCERPC Protocol Heap Overflow Remote Code Execution Vulnerability (CVE-2024-37079) Security Advisory
[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, and VMware Cloud Foundation versions 4.x and 5.x.
[Impact] An unauthenticated remote attacker can trigger a heap-based buffer overflow to execute arbitrary code with root privileges by sending crafted network packets.
[Mitigation] Immediately upgrade to the patched versions (vCenter 8.0 U2b / 7.0 U3r or higher) and restrict network access to DCERPC-related ports.
VMware vCenter Server DCERPC Protocol Out-of-Bounds Write Vulnerability (CVE-2023-34048) Security Advisory
[Affected Scope] VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series
[Impact] An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges
[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls