Vmware Security Vulnerabilities (CVEs)

CVE-2026-22719 is a command injection vulnerability in VMware Aria Operations that allows unauthenticated attackers to execute arbitrary commands duri...

This CVE describes a local privilege escalation vulnerability in VMware Aria Operations and VMware Tools. A malicious local user with non-administrati...

VMware NSX Manager UI has a stored XSS vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This affe...

VMware NSX contains a stored Cross-Site Scripting vulnerability in the router port due to improper input validation. This allows authenticated attacke...

VMware Cloud Foundation contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions and access limi...

This DOM-based XSS vulnerability in VMware Aria Automation allows attackers to steal authenticated users' access tokens by tricking them into clicking...

This vulnerability allows attackers with administrative privileges on a virtual machine to read memory from the host's vmx process, potentially exposi...

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability that allows authenticated non-administrative users to inject mali...

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability where an authenticated admin user can inject malicious scripts. W...

VMware Aria Operations contains an information disclosure vulnerability where authenticated non-administrative users can retrieve credentials for outb...

VMware Aria Operations for Logs contains an information disclosure vulnerability where authenticated users with View Only Admin permissions can read c...

CVE-2024-38830 is a local privilege escalation vulnerability in VMware Aria Operations. Attackers with local administrative access can exploit this to...

VMware Aria Operations contains a stored cross-site scripting vulnerability that allows authenticated users with editing access to inject malicious sc...

VMware Aria Operations contains a stored cross-site scripting vulnerability that allows authenticated users with editing access to cloud providers to ...

An authenticated SQL injection vulnerability in VMware HCX allows authenticated non-administrator users to execute arbitrary SQL queries, potentially ...

CVE-2024-38811 is a code execution vulnerability in VMware Fusion where attackers with standard user privileges can exploit an insecure environment va...

CVE-2024-22280 is a SQL injection vulnerability in VMware Aria Automation that allows authenticated attackers to execute arbitrary SQL queries. This e...

This vulnerability allows a malicious actor with local administrative privileges on a virtual machine with an existing snapshot to trigger an out-of-b...

CVE-2024-37081 is a local privilege escalation vulnerability in VMware vCenter Server caused by sudo misconfigurations. Authenticated local users with...

CVE-2024-22274 is an authenticated remote code execution vulnerability in VMware vCenter Server. Attackers with administrative shell access on the vCe...

This vulnerability allows a malicious actor with local administrative privileges on a VMware virtual machine to read privileged information from hyper...

Spring Framework applications using UriComponentsBuilder to parse external URLs with host validation are vulnerable to open redirect and SSRF attacks....

This CVE describes an out-of-bounds write vulnerability in VMware ESXi that could allow a malicious actor with VMX process privileges to escape the sa...

This vulnerability in Spring Security allows broken access control when applications directly use AuthenticationTrustResolver.isFullyAuthenticated() w...

This CVE describes a local privilege escalation vulnerability in VMware Aria Operations for Networks. Console users with existing access can exploit t...

This vulnerability in Spring Framework allows attackers to cause denial-of-service (DoS) conditions by sending specially crafted HTTP requests. Applic...

CVE-2022-22942 is a local privilege escalation vulnerability in the vmwgfx driver that allows unprivileged local users to access files opened by other...

This CVE is an open redirect vulnerability in VMware Workspace ONE UEM console that allows attackers to redirect victims to malicious sites and potent...

CVE-2023-34059 is a file descriptor hijack vulnerability in open-vm-tools' vmware-user-suid-wrapper that allows non-root users to hijack the /dev/uinp...

CVE-2023-34057 is a local privilege escalation vulnerability in VMware Tools that allows a user with local access to a guest virtual machine to elevat...

This vulnerability allows an attacker with local administrative privileges on a VMware virtual machine to read privileged information from hypervisor ...

This CVE describes a privilege escalation vulnerability in VMware vSphere where a malicious actor with Guest Operation Privileges in a target virtual ...

This vulnerability allows authenticated administrative users in VMware Aria Operations for Networks to write files to arbitrary locations, potentially...

This vulnerability allows attackers with network access to VMware vCenter Server to send specially crafted DCERPC packets causing memory corruption th...

This CVE describes a heap overflow vulnerability in vCenter Server's DCERPC protocol implementation due to uninitialized memory usage. Attackers with ...

This vulnerability in VMware Aria Operations for Networks allows attackers with network access to execute arbitrary commands through command injection...

This vulnerability in Spring Boot allows denial-of-service attacks when Spring MVC applications are deployed behind reverse proxy caches. Attackers ca...

Greenplum Database versions before 6.22.3 have a path traversal vulnerability in tar file extraction within GPPKGs. This allows attackers to write arb...