VMware Vulnerabilities and Affected Products
Vulnerabilities associated with VMware Cloud Foundation (vCenter Server).
Products
Clear product- Workstation54 vulnerabilities
- Fusion49 vulnerabilities
- ESXi33 vulnerabilities
- Cloud Foundation17 vulnerabilities
- cloud_foundation17 vulnerabilities
- Telco Cloud Platform17 vulnerabilities
- vCenter Server15 vulnerabilities
- VMware Aria Operations15 vulnerabilities
- Telco Cloud Infrastructure14 vulnerabilities
- VMware ESXi14 vulnerabilities
- Spring Framework12 vulnerabilities
- SALT11 vulnerabilities
- Horizon View Client for Windows9 vulnerabilities
- Avi Load Balancer8 vulnerabilities
- VMware Telco Cloud Platform8 vulnerabilities
- vSphere Foundation7 vulnerabilities
- Workstation Pro / Player6 vulnerabilities
- Workstation Pro/Player6 vulnerabilities
- Fusion Pro / Fusion5 vulnerabilities
- nsx5 vulnerabilities
- Spring AI5 vulnerabilities
- VMware Cloud Foundation5 vulnerabilities
- VMware Cloud Foundation (vCenter Server)5 vulnerabilities
- VMware Fusion5 vulnerabilities
- VMware vCenter Server (vCenter Server)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-20896MEDIUM | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd). CWE-125Jun 22, 2023 | CVSS5.9v3.1 | EPSS0.909% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-20895HIGH | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. CWE-787Jun 22, 2023 | CVSS8.1v3.1 | EPSS1.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-20894HIGH | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. CWE-787Jun 22, 2023 | CVSS8.1v3.1 | EPSS33.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-20893HIGH | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. CWE-416Jun 22, 2023 | CVSS8.1v3.1 | EPSS1.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-20892HIGH | VMware vCenter Server heap-overflow vulnerabilityThe vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. CWE-787Jun 22, 2023 | CVSS8.1v3.1 | EPSS1.85% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |