Product:

Cloud_foundation

(Vmware)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 116
Date Id Summary Products Score Patch Annotated
2025-01-30 CVE-2025-22221 VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent Configuration. Aria_operations_for_logs, Cloud_foundation 4.8
2022-10-28 CVE-2022-31678 VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. Cloud_foundation, Nsx_data_center 9.1
2024-03-05 CVE-2024-22253 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. Cloud_foundation, Esxi, Fusion, Workstation 6.7
2024-03-05 CVE-2024-22254 VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox. Cloud_foundation, Esxi 8.2
2024-03-05 CVE-2024-22255 VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.   Cloud_foundation, Esxi, Fusion, Workstation N/A
2024-02-21 CVE-2024-22235 VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. Aria_operations, Cloud_foundation 6.7
2024-07-11 CVE-2024-22280 VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database. Aria_automation, Cloud_foundation 8.1
2021-03-31 CVE-2021-21975 Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials. Cloud_foundation, Vrealize_operations_manager, Vrealize_suite_lifecycle_manager 7.5
2022-04-11 CVE-2022-22954 VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. Cloud_foundation, Identity_manager, Vrealize_automation, Vrealize_suite_lifecycle_manager, Workspace_one_access 9.8
2025-03-04 CVE-2025-22225 VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. Cloud_foundation, Esxi, Telco_cloud_infrastructure, Telco_cloud_platform N/A