cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2025-22222,https://securityvulnerability.io/vulnerability/CVE-2025-22222,Information Disclosure Flaw in VMware Aria Operations,"VMware Aria Operations is susceptible to an information disclosure vulnerability that allows a malicious user with non-administrative access to exploit the flaw. By leveraging this vulnerability, an attacker could potentially retrieve sensitive credentials associated with an outbound plugin if they possess a valid service credential ID. This risk underlines the need for enhanced security measures to protect user credentials and prevent unauthorized access.",Vmware,Vmware Aria Operations,7.7,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,false,,2025-01-30T15:32:00.829Z,0
CVE-2025-22218,https://securityvulnerability.io/vulnerability/CVE-2025-22218,Information Disclosure in VMware Aria Operations for Logs,"VMware Aria Operations for Logs is affected by a vulnerability that allows unauthorized users with View Only Admin permissions to access sensitive credentials of integrated VMware products. This exposure can potentially lead to further exploitation of the system, compromising overall security and integrity.",Vmware,Vmware Aria Operations For Logs,8.5,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,false,,2025-01-30T14:23:01.810Z,0
CVE-2024-38832,https://securityvulnerability.io/vulnerability/CVE-2024-38832,VMware Aria Operations Stored XSS Vulnerability,"VMware Aria Operations is affected by a stored cross-site scripting vulnerability that permits a malicious actor with editing access to views to inject harmful scripts. This flaw can compromise user data and session integrity, posing significant risks to application security. It is advised for users and administrators to review their access controls and apply any necessary patches to mitigate this vulnerability.",Vmware,Vmware Aria Operations,7.1,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-11-26T11:51:39.551Z,0
CVE-2024-38831,https://securityvulnerability.io/vulnerability/CVE-2024-38831,VMware Aria Operations Local Privilege Escalation Vulnerability,"VMware Aria Operations is exposed to a local privilege escalation vulnerability that allows a malicious actor, who already possesses local administrative privileges, to escalate their privileges to that of a root user. This can be achieved by inserting malicious commands into the properties file on the appliance running VMware Aria Operations. Organizations using this product should review their permissions and implement appropriate security measures to prevent exploitation.",Vmware,Vmware Aria Operations,7.8,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-11-26T11:50:20.202Z,0
CVE-2024-38830,https://securityvulnerability.io/vulnerability/CVE-2024-38830,Local Privilege Escalation Vulnerability Affects VMware Aria Operations,"VMware Aria Operations is susceptible to a local privilege escalation vulnerability that allows a malicious actor with existing local administrative privileges to escalate their access to the root user level on the appliance. This weakness poses a serious risk as it can lead to unauthorized control of the system, enabling the attacker to perform critical actions that can compromise the integrity and confidentiality of the underlying infrastructure. Organizations must assess their deployments and apply the necessary mitigations to protect their systems from potential exploitation.",Vmware,Vmware Aria Operations,7.8,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-11-26T11:49:16.781Z,0
CVE-2024-38814,https://securityvulnerability.io/vulnerability/CVE-2024-38814,VMware HCX Authenticated SQL Injection Vulnerability,"The article discusses a high-severity SQL injection vulnerability in VMware HCX, tracked as CVE-2024-38814, which allows non-admin users to execute remote code on the HCX manager. The vulnerability was privately reported to VMware, impacting multiple versions of the HCX platform. An authenticated user with non-admin rights could exploit the flaw and execute unauthorized remote code on the HCX manager. The article also mentions that updates are available to remediate this vulnerability in affected VMware products.",VMware,Vmware Hcx,8.8,HIGH,0.0006900000153109431,false,,true,false,true,2024-10-16T00:00:00.000Z,,false,false,,2024-10-16T17:15:00.000Z,0
CVE-2024-38813,https://securityvulnerability.io/vulnerability/CVE-2024-38813,Privilege escalation vulnerability,"A privilege escalation vulnerability exists in VMware vCenter Server, enabling a remote attacker with network access to elevate their privileges to root. This is exploited by sending specially crafted network packets aimed at the vCenter Server. It is crucial for organizations using affected versions to assess their security posture and implement necessary safeguards to protect their systems against potential exploits.",Vmware,"Vmware Vcenter Server,Vmware Cloud Foundation",7.5,HIGH,0.0041600000113248825,true,2024-11-20T00:00:00.000Z,true,false,true,2024-11-20T00:00:00.000Z,,false,false,,2024-09-17T18:15:00.000Z,0
CVE-2024-38812,https://securityvulnerability.io/vulnerability/CVE-2024-38812,vCenter Server Heap Overflow Vulnerability,"A heap-overflow vulnerability exists in the vCenter Server's implementation of the DCERPC protocol, allowing a remote attacker with network access to exploit this weakness. By sending a specially crafted network packet, the attacker may be able to execute arbitrary code on the affected system. This vulnerability poses a significant risk, as it could lead to unauthorized access or control over the system, highlighting the importance of maintaining robust network security practices and applying updates promptly.",VMware,"Vmware Vcenter Server,Vmware Cloud Foundation",9.8,CRITICAL,0.0041600000113248825,true,2024-11-20T00:00:00.000Z,true,false,true,2024-09-18T06:08:27.000Z,true,true,true,2024-09-18T19:52:02.370Z,2024-09-17T18:15:00.000Z,6630
CVE-2024-38811,https://securityvulnerability.io/vulnerability/CVE-2024-38811,VMware Fusion Vulnerability Allows Code Execution with Standard User Privileges,"VMware Fusion versions prior to 13.6 are vulnerable to a code-execution issue stemming from the use of an insecure environment variable. This flaw enables an attacker with standard user privileges to execute arbitrary code within the context of the Fusion application, potentially leading to unauthorized actions or further exploitation of the environment. Organizations using VMware Fusion should address this vulnerability by updating to the latest version to mitigate potential risks associated with this security gap.",VMware,Fusion,7.8,HIGH,0.0004199999966658652,false,,true,false,false,,,false,false,,2024-09-03T09:47:28.120Z,0
CVE-2024-22280,https://securityvulnerability.io/vulnerability/CVE-2024-22280,VMware Aria Automation Vulnerability,"VMware Aria Automation exhibits a vulnerability due to insufficient input validation, enabling an authenticated user to execute crafted SQL queries. This flaw can lead to unauthorized data manipulation, allowing malicious actors to perform read or write operations directly in the underlying database. It is imperative for users of affected versions to assess their security measures and apply necessary updates or patches to safeguard their environments.",Vmware,Vmware Aria Automation,8.1,HIGH,0.0004600000102072954,false,,false,false,false,,,false,false,,2024-07-11T04:39:09.353Z,0
CVE-2024-22271,https://securityvulnerability.io/vulnerability/CVE-2024-22271,Spring Cloud Function Web DOS Vulnerability,"The Spring Cloud Function Framework is susceptible to a Denial of Service (DoS) attack when users attempt to compose functions that do not exist. This vulnerability is present in versions 4.1.x prior to 4.1.2 and 4.0.x prior to 4.0.8, specifically when the Spring Cloud Function Web module is employed. Exploiting this vulnerability could hinder the application's functionality and accessibility, as it can cause significant interruptions when improper function compositions occur.",Spring By Vmware Tanzu,Spring Cloud Function Framework,8.2,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-07-09T13:15:00.000Z,0
CVE-2024-22232,https://securityvulnerability.io/vulnerability/CVE-2024-22232,Specially crafted url can be created which leads to a directory traversal in the salt file server,"A directory traversal vulnerability in the Salt File Server allows an attacker to craft a specially designed URL that exploits the server's file path handling. This vulnerability enables a malicious user to access arbitrary files on the Salt master’s filesystem, potentially leading to unauthorized disclosure of sensitive information. Admins of affected systems should implement security measures and updates to mitigate this vulnerability and protect against unauthorized file access.",Vmware,Salt Project,7.7,HIGH,0.0004400000034365803,false,,false,false,false,,,false,false,,2024-06-27T06:54:08.785Z,0
CVE-2024-37085,https://securityvulnerability.io/vulnerability/CVE-2024-37085,VMware ESXi Authentication Bypass Vulnerability,"VMware ESXi is susceptible to a critical authentication bypass vulnerability that enables a malicious actor with appropriate Active Directory permissions to gain unauthorized access to the ESXi host. This situation arises when the 'ESXi Admins' AD group, used for user management, is deleted from Active Directory and subsequently recreated by the attacker. Restoring this group allows elevated access rights, compromising the integrity of the host and potentially exposing sensitive information and functionalities. Administrators are advised to review access control measures and implement best practices to mitigate the risk associated with this vulnerability.",VMware,"Vmware Esxi,Vmware Cloud Foundation",7.2,HIGH,0.010470000095665455,true,2024-07-30T00:00:00.000Z,true,true,true,2024-06-26T07:00:26.000Z,false,true,true,2024-08-03T17:52:02.752Z,2024-06-25T14:16:01.280Z,65164
CVE-2024-22263,https://securityvulnerability.io/vulnerability/CVE-2024-22263,Malicious File Write Vulnerability in Skipper Server,"The vulnerability allows a malicious user with access to the Skipper server API of Spring Cloud Data Flow to exploit improper sanitization of upload paths. This can lead to crafted upload requests that write arbitrary files to any location in the file system, potentially compromising the integrity of the server and exposing sensitive data.",Spring By Vmware Tanzu,Spring Cloud Skipper,8.8,HIGH,0.0004299999854993075,false,,false,false,true,2024-08-22T04:58:25.000Z,true,false,false,,2024-06-19T14:48:10.644Z,0
CVE-2024-37081,https://securityvulnerability.io/vulnerability/CVE-2024-37081,VMware vCenter Server Local Privilege Escalation Vulnerabilities,"The CVE-2024-37081 vulnerability in VMware vCenter Server allows an authenticated local user with non-administrative privileges to elevate privileges to root on the vCenter Server Appliance. This is a local privilege escalation vulnerability due to misconfiguration of sudo. The potential impact of this vulnerability is significant, as it can allow unauthorized elevation of privileges on the vCenter Server. The vendor affected by this vulnerability is VMware. There are no known exploits of this vulnerability by ransomware groups at this time.",VMware,"Vmware Vcenter Server,Vmware Cloud Foundation",7.8,HIGH,0.00279000005684793,false,,true,false,true,2024-07-07T03:29:13.000Z,true,false,false,,2024-06-18T05:43:20.580Z,0
CVE-2024-37080,https://securityvulnerability.io/vulnerability/CVE-2024-37080,vCenter Server Heap Overflow Vulnerability,"VMware vCenter Server is susceptible to a heap overflow vulnerability associated with the DCERPC protocol implementation. Malicious actors with network access can exploit this flaw by sending a specially crafted network packet. This breach may result in remote code execution, granting unauthorized access and control over affected systems. Organizations utilizing vCenter Server should prioritize applying patches and updates to mitigate potential risks.",VMware,"Vmware Vcenter Server,Vmware Cloud Foundation",9.8,CRITICAL,0.0009299999801442027,false,,true,false,true,2024-06-19T15:39:17.000Z,,false,false,,2024-06-18T05:43:10.901Z,0
CVE-2024-37079,https://securityvulnerability.io/vulnerability/CVE-2024-37079,vCenter Server Heap Overflow Vulnerability,"vCenter Server is impacted by a heap-overflow vulnerability within its DCERPC protocol implementation. This flaw allows an attacker with network access to exploit the vulnerability by delivering specially crafted network packets. If executed successfully, this exploitation could lead to unauthorized remote code execution, posing severe risks to system integrity and confidentiality. It is critical for organizations using affected versions of vCenter Server to implement appropriate security measures to mitigate potential threats stemming from this vulnerability.",VMware,"Vmware Vcenter Server,Vmware Cloud Foundation",9.8,CRITICAL,0.0009299999801442027,false,,true,false,false,,,true,false,,2024-06-18T05:43:06.619Z,6722
CVE-2024-22274,https://securityvulnerability.io/vulnerability/CVE-2024-22274,VMware vCenter Server Remote Code Execution Vulnerability,"The vulnerability identified as CVE-2024-22274 affects VMware vCenter Server and allows a malicious actor with administrative privileges to run arbitrary commands on the underlying operating system. The vulnerability has been exploited and a proof-of-concept (PoC) exploit has been released, potentially allowing remote code execution. This poses a serious risk as it can give attackers full control of the affected system. The vulnerability affects specific API components and arbitrary commands can be executed with root privileges. VMware has recommended applying updates to the affected deployments and emphasizes the importance of maintaining up-to-date security measures in virtualization environments. Currently, no workarounds are available, and organizations are urged to assess their systems and apply the necessary updates to mitigate the risk of potential exploitation.",VMware,"Vmware Vcenter Server,Vmware Cloud Foundation (vcenter Server)",7.2,HIGH,0.0004299999854993075,false,,true,false,true,2024-07-07T02:55:25.000Z,true,false,false,,2024-05-21T17:29:33.899Z,0
CVE-2024-22273,https://securityvulnerability.io/vulnerability/CVE-2024-22273,VMware ESXi Storage Controllers Vulnerable to Out-of-Bounds Read/Write Attacks,"The vulnerability involves an out-of-bounds read/write issue within the storage controllers of VMware ESXi, Workstation, and Fusion. A malicious actor with access to a virtual machine enabled with these storage controllers can exploit this vulnerability. The exploitation may result in a denial of service condition or allow the execution of arbitrary code on the hypervisor, especially when leveraged in conjunction with other vulnerabilities. This situation poses significant risk to virtualized environments relying on VMware's products, underscoring the necessity for timely security updates and patches.",VMware,"Vmware Esxi,Vmware Workstation,Vmware Fusion,Vmware Cloud Foundation (esxi)",8.1,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-05-21T17:29:05.426Z,0
CVE-2024-22264,https://securityvulnerability.io/vulnerability/CVE-2024-22264,Privilege Escalation Vulnerability in VMware Avi Load Balancer Allows Root Access,"The VMware Avi Load Balancer has a vulnerability that allows malicious actors, who have acquired admin access, to escalate their privileges. This flaw permits them to create, modify, execute, and delete files as a root user on the underlying host system. This unauthorized access can lead to a range of security issues, including data breaches and system manipulation. Organizations using VMware Avi Load Balancer should assess their systems for potential exposure to this vulnerability and implement necessary security measures to ensure data integrity and system stability.",Vmware,Vmware Avi Load Balancer,7.2,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-05-08T03:57:31.985Z,0
CVE-2024-22255,https://securityvulnerability.io/vulnerability/CVE-2024-22255,Information disclosure vulnerability,"VMware ESXi, Workstation, and Fusion have a vulnerability within the UHCI USB controller that may lead to information disclosure. If an attacker gains administrative access to a virtual machine, they could potentially exploit this vulnerability to extract sensitive memory content from the vmx process, posing risks to data confidentiality and system integrity. Users are advised to apply the latest security updates to mitigate the risks associated with this vulnerability.",VMware,"Vmware Esxi,Vmware Workstation,Vmware Fusion,Vmware Cloud Foundation",7.1,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-03-05T17:58:35.987Z,0
CVE-2024-22254,https://securityvulnerability.io/vulnerability/CVE-2024-22254,VMware ESXi Out-of-Bounds Write Vulnerability,"An out-of-bounds write vulnerability exists in VMware ESXi, specifically affecting the VMX process. This flaw allows a malicious actor with certain privileges to exploit the vulnerability, which may result in an escape from the sandbox environment. By manipulating memory effectively, an attacker could potentially execute arbitrary code outside the intended execution flow, compromising the integrity and security of the virtualized environment. Organizations using VMware ESXi should assess their systems and apply necessary patches to mitigate potential risks associated with this vulnerability.",VMware,"Vmware Esxi,Vmware Cloud Foundation",7.9,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-03-05T17:58:24.341Z,0
CVE-2024-22253,https://securityvulnerability.io/vulnerability/CVE-2024-22253,Use-after-free vulnerability,"VMware ESXi, Workstation, and Fusion exhibit a use-after-free vulnerability associated with the UHCI USB controller. This flaw allows a malicious user with local administrative privileges on a virtual machine to exploit the vulnerability, potentially executing arbitrary code within the VMX process on the host system. On ESXi, this exploitation is limited to the VMX sandbox environment. In contrast, on Workstation and Fusion, successful exploitation could permit the execution of code directly on the host machine, posing a significant security risk to users.",VMware,"Vmware Esxi,Vmware Workstation,Vmware Fusion,Vmware Cloud Foundation",9.3,CRITICAL,0.0004299999854993075,false,,true,false,false,,,false,false,,2024-03-05T17:57:27.297Z,0
CVE-2024-22252,https://securityvulnerability.io/vulnerability/CVE-2024-22252,Use-after-free vulnerability,"VMware ESXi, Workstation, and Fusion exhibit a use-after-free vulnerability associated with the XHCI USB controller. This threat arises from the ability of a malicious actor who has local administrative privileges on a virtual machine to exploit this vulnerability, potentially leading to code execution as the virtual machine's VMX process on the host. While exploitation on ESXi remains within the VMX sandbox, vulnerabilities in Workstation and Fusion may enable code execution on the host machines. Administrators should prioritize patching to mitigate potential security risks.",VMWare,"Vmware Esxi,Vmware Workstation,Vmware Fusion,Vmware Cloud Foundation",9.3,CRITICAL,0.0004299999854993075,false,,true,false,true,2024-08-15T23:15:06.000Z,,true,false,,2024-03-05T17:57:22.043Z,3285
CVE-2024-22250,https://securityvulnerability.io/vulnerability/CVE-2024-22250,Privileged Session Hijacking Vulnerability in VMware Enhanced Authentication Plug-in,"The vulnerability exists in the Deprecated VMware Enhanced Authentication Plug-in, where a session hijack can occur. This allows a malicious actor with unprivileged local access to a Windows operating system to hijack a privileged EAP session initiated by a privileged domain user on the same system. This vulnerability poses significant risks, as it can lead to unauthorized access to sensitive operations or data within the affected environment, highlighting the urgent need for remediation to protect user sessions.",Vmware,Vmware Enhanced Authentication Plug-in (eap),7.8,HIGH,0.0004299999854993075,false,,true,false,false,,,false,false,,2024-02-20T17:35:23.481Z,0