Vmware Luki w zabezpieczeniach

Oś czasu

Rodzaj

Produkt

VMware Workstation173
VMware Fusion102
VMware ESXi98
VMware Player78
VMware vCenter Server64

Przeciwdziałanie

Official Fix663
Temporary Fix0
Workaround5
Unavailable8
Not Defined68

Wykorzystywanie

High22
Functional6
Proof-of-Concept128
Unproven29
Not Defined559

Wektor dostępu

Not Defined0
Physical4
Local225
Adjacent91
Network424

Uwierzytelnianie

Not Defined0
High56
Low315
None373

Interakcja z użytkownikiem

Not Defined0
Required76
None668

C3BM Index

CVSSv3 Base

≤10
≤20
≤311
≤452
≤584
≤6162
≤7143
≤8147
≤971
≤1074

CVSSv3 Temp

≤10
≤21
≤313
≤460
≤5114
≤6160
≤7158
≤8115
≤987
≤1036

VulDB

≤10
≤22
≤324
≤484
≤591
≤6181
≤7107
≤8130
≤953
≤1072

NVD

≤10
≤20
≤30
≤48
≤515
≤659
≤762
≤8110
≤952
≤1055

CNA

≤10
≤20
≤30
≤42
≤55
≤610
≤78
≤814
≤98
≤108

Sprzedawca

≤10
≤20
≤30
≤40
≤50
≤61
≤71
≤80
≤91
≤104

Research

≤10
≤20
≤30
≤40
≤50
≤60
≤70
≤80
≤91
≤100

Exploit 0-day

<1k1
<2k17
<5k85
<10k238
<25k322
<50k70
<100k11
≥100k0

Wykorzystaj dzisiaj

<1k581
<2k64
<5k68
<10k21
<25k8
<50k2
<100k0
≥100k0

Wykorzystaj wielkość rynku

🔴 CTI Zajęcia

Affected Products (167): ACE (11), Access Connector (1), AirWatch (3), AirWatch Agent (2), AirWatch Console (3), AirWatch Inbox (2), AirWatch Launcher (1), App Volumes (2), Aria Automation (1), Aria Operations (7), Aria Operations for Logs (4), Aria Operations for Networks (10), CNS Edge (1), Carbon Black App Control (4), Carbon Black Cloud Workload Appliance (1), Center (6), Center CapacityIQ (1), Center Chargeback Manager (1), Center Operations (2), Center Server (64), Center Server Appliance (8), Center Update Manager (1), Cloud Automation Center (1), Cloud Director (4), Cloud Director Appliance (1), Cloud Director for Service Providers (1), Cloud Foundation (26), Cloud Foundation ESXi (2), Connectors (1), ESX (24), ESX Server (16), ESXi (99), ESXi Server (2), Enhanced Authentication Plug-in (2), Enterprise (1), Fabric tc Server (1), Fusion (102), Fusion Pro (4), GSX Server (2), GemFire (2), HCX (1), Horizon (1), Horizon Client (19), Horizon Client for Mac (3), Horizon Connection Server (1), Horizon DaaS (3), Horizon Server (3), Horizon View (3), Horizon View Agent (2), Horizon View Client (11), Hyperic Agent (1), Hyperic HQ (2), Hyperic HQ Groovy Script Console (1), Hyperic Server (2), Identity Manager (26), Identity Manager Connector (1), Isolation Segment (1), Movie Decoder (1), NSX (1), NSX-T (3), NSX-V Edge (1), NSX Data Center for vSphere (1), NSX Edge (2), NSX SD-WAN Edge (1), OVF Tool (1), Open Virtual Machine Tools (1), Photon (1), Photon OS (2), Pinniped (2), Pivotal Scheduler (1), Player (80), RabbitMQ (2), Reactor Netty (1), Realize Automation (24), Realize Business Advance (1), Realize Business for Cloud (1), Realize Log Insight (14), Realize Network Insight (2), Realize Operations (16), Realize Operations Manager API (6), Realize Operations Tenant App (1), Realize Orchestrator (3), Realize Suite Lifecycle Manager (2), Remote Console (3), Remote Console for Mac (3), SD-WAN (1), SD-WAN Edge (3), SD-WAN Orchestrator (7), Server (32), Shield Manager (1), Sphere Client (5), Sphere Data Protection (9), Sphere ESXi (1), Sphere Integrated Containers (1), Sphere Replication (1), Sphere Web Client (3), Spring (4), Spring-integration-zip (1), Spring AMQP (3), Spring Authorization Server (1), Spring Boot (5), Spring Cloud Data Flow (1), Spring Cloud Function (2), Spring Cloud Gateway (3), Spring Cloud Netflix Zuul (1), Spring Cloud OpenFeign (1), Spring Cloud Task (1), Spring Data MongoDB (1), Spring Data REST (2), Spring Framework (12), Spring HATEOAS (1), Spring Reactor Netty (1), Spring Security (12), Spring Security OAuth (1), Spring Session (1), SpringSource Spring Security (5), Spring Tools (1), Spring Vault (1), Spring for Apache Kafka (1), Spring for GraphQL (1), Stage Manager (1), Studio (3), Support Tools (2), Tanzu (1), Tanzu Application Service for VMs (3), Tanzu GemFire for VMs (2), Thinapp (1), Tivoli Storage Manager for Virtual Environments (1), Tools (18), Unified Access Gateway (1), V4H (1), V4PA (1), VI-Client (1), VIX API (1), VMRC (1), VSCode Extension (1), Velero (1), View (6), View Manager (1), View Planner (1), Virtual Center (1), VirtualCenter (4), Virtual Infrastructure (1), Workspace ONE Access (27), Workspace ONE Assist (5), Workspace ONE Boxer (1), Workspace ONE Content (1), Workspace ONE Launcher (1), Workspace ONE SDK (1), Workspace ONE UEM Console (2), Workspace ONE Unified Endpoint Management Console (1), Workspace One Access (1), Workspace one UEM Console (2), Workstation (177), Workstation Player (6), Workstation Pro (12), Xenon (1), Zimbra (1), Zimbra Collaboration Suite (2), Zimbra Collection Suite (1), Zimbra Desktop (1), Zimbra Web Client (1), macOS Sensor for VMware Carbon Black Cloud (1), open-vm-tools (2), tc Server (1), vMA (1), workstation (1)

Link to Vendor Website: https://www.vmware.com/

OpublikowanoBaseTempSłaby punktProdWykPrzEPSSCTICVE
2024-04-024.34.1Vmware SD-WAN Orchestrator RedirectNetwork Management SoftwareNot DefinedOfficial Fix0.000430.02CVE-2024-22248
2024-04-024.34.1Vmware SD-WAN Edge BIOS Configuration weak authenticationNetwork Management SoftwareNot DefinedOfficial Fix0.000430.00CVE-2024-22247
2024-04-027.06.7Vmware SD-WAN Edge privilege escalationNetwork Management SoftwareNot DefinedOfficial Fix0.000430.05CVE-2024-22246
2024-03-205.75.6Vmware Spring Authorization Server PKCE weak encryptionNieznanyNot DefinedOfficial Fix0.000430.03CVE-2024-22258
2024-03-187.77.6Vmware Spring Security AuthenticatedVoter privilege escalationNieznanyNot DefinedOfficial Fix0.000430.02CVE-2024-22257
2024-03-167.27.0VMware Spring Framework UriComponentsBuilder privilege escalationNieznanyNot DefinedOfficial Fix0.000430.02CVE-2024-22259
2024-03-077.67.5VMware Cloud Director Organization Name information disclosureCloud SoftwareNot DefinedOfficial Fix0.000430.06CVE-2024-22256
2024-03-056.05.9VMware ESXi/Cloud Foundation VMX Process memory corruptionCloud SoftwareNot DefinedOfficial Fix0.000430.03CVE-2024-22254
2024-03-058.07.8VMware ESXi/Workstation/Fusion/Cloud Foundation UHCI USB Controller memory corruptionVirtualization SoftwareNot DefinedOfficial Fix0.000430.02CVE-2024-22253
2024-03-058.07.8VMware ESXi/Workstation/Fusion/Cloud Foundation XHCI USB Controller memory corruptionVirtualization SoftwareNot DefinedOfficial Fix0.000430.05CVE-2024-22252
2024-03-054.74.6VMware ESXi/Workstation/Fusion/Cloud Foundation UHCI USB Controller information disclosureVirtualization SoftwareNot DefinedOfficial Fix0.000430.02CVE-2024-22255
2024-02-274.14.0VMware Workstation/Fusion USB CCID information disclosureVirtualization SoftwareNot DefinedOfficial Fix0.000430.05CVE-2024-22251
2024-02-237.27.0VMware Spring Framework URL Parser UriComponentsBuilder privilege escalationNieznanyNot DefinedOfficial Fix0.000430.02CVE-2024-22243
2024-02-216.76.5VMware Aria Operations Local Privilege EscalationNieznanyNot DefinedOfficial Fix0.000430.05CVE-2024-22235
2024-02-208.07.9VMware Enhanced Authentication Plug-in weak authenticationNieznanyNot DefinedWorkaround0.000430.04CVE-2024-22250
2024-02-209.29.1VMware Enhanced Authentication Plug-in Active Directory weak authenticationNieznanyNot DefinedWorkaround0.000430.03CVE-2024-22245
2024-02-206.56.4VMware Spring Security AuthenticationTrustResolver.isFullyAuthenticated privilege escalationNieznanyNot DefinedOfficial Fix0.000430.04CVE-2024-22234
2024-02-063.83.8VMware Aria Operations for Networks cross site scriptingNieznanyNot DefinedOfficial Fix0.000430.02CVE-2024-22241
2024-02-063.83.7VMware Aria Operations for Networks information disclosureNieznanyNot DefinedOfficial Fix0.000460.02CVE-2024-22240
2024-02-066.16.1VMware Aria Operations for Networks Console privilege escalationNieznanyNot DefinedOfficial Fix0.000420.02CVE-2024-22239
2024-02-064.54.5VMware Aria Operations for Networks cross site scriptingNieznanyNot DefinedOfficial Fix0.000430.02CVE-2024-22238
2024-02-067.87.6VMware Aria Operations for Networks privilege escalationNieznanyNot DefinedOfficial Fix0.000420.03CVE-2024-22237
2024-02-064.24.2VMware Spring Security spring-security.xsd privilege escalationNieznanyNot DefinedOfficial Fix0.000420.02CVE-2023-34042
2024-01-227.57.3VMware Spring Framework HTTP Request denial of serviceNieznanyNot DefinedOfficial Fix0.000520.03CVE-2024-22233
2024-01-169.08.9VMware Aria Automation/Cloud Foundation privilege escalationAutomation SoftwareNot DefinedOfficial Fix0.000430.04CVE-2023-34063

719 więcej wpisów nie jest pokazywanych

Might our Artificial Intelligence support you?

Check our Alexa App!