VYPR
← VMware

Vendor CVEs

VMware

All CVEs

1,102 total · sorted by risk
  • CVE-2011-2731Dec 5, 2012
    VMware
    Spring Security
    risk 0.00cvss —epss 0.01

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

  • CVE-2009-2899Dec 5, 2012
    VMware
    Hyperic Hq
    risk 0.00cvss —epss 0.00

    The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.

  • CVE-2012-5703Nov 20, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request.

  • CVE-2012-5459Nov 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."

  • CVE-2012-5458Nov 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak permissions for unspecified process threads, which allows host OS users to gain host OS privileges via a crafted application.

  • CVE-2012-5051Oct 5, 2012
    VMware
    Capacityiq
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in VMware CapacityIQ 1.5.x allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2012-5050Oct 5, 2012
    VMware
    Vcenter Operations
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the server in VMware vCenter Operations (aka vCOps) before 5.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4897Oct 5, 2012
    VMware
    Movie Decoder
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the installer in VMware Movie Decoder before 9.0 allows local users to gain privileges via a Trojan horse executable file in the installer directory.

  • CVE-2012-1833Sep 28, 2012
    VMware
    SpringSource Grails
    risk 0.00cvss —epss 0.01

    VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.

  • CVE-2012-3289Jun 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device.

  • CVE-2012-3288Jun 14, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    VMware Workstation 7.x before 7.1.6 and 8.x before 8.0.4, VMware Player 3.x before 3.1.6 and 4.x before 4.0.4, VMware Fusion 4.x before 4.1.3, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow user-assisted remote attackers to execute arbitrary code on the host…

  • CVE-2012-2752Jun 1, 2012
    VMware
    Vma
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in VMware vMA 4.x and 5.x before 5.0.0.2 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2012-2450May 4, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write…

  • CVE-2012-2449May 4, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service…

  • CVE-2012-2448May 4, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.03

    VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS traffic.

  • CVE-2012-1517May 4, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers.

  • CVE-2012-1518Apr 17, 2012
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via…

  • CVE-2012-1515Apr 2, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.01

    VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.

  • CVE-2012-1514Mar 16, 2012
    VMware
    Vshield Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2012-1513Mar 16, 2012
    VMware
    Vcenter Orchestrator
    risk 0.00cvss —epss 0.01

    The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading…

  • CVE-2012-1512Mar 16, 2012
    VMware
    Vsphere
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry.

  • CVE-2012-1511Mar 16, 2012
    VMware
    View
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2012-1510Mar 16, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.00

    Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.

  • CVE-2012-1509Mar 16, 2012
    VMware
    View
    risk 0.00cvss —epss 0.00

    Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.

  • CVE-2012-1508Mar 16, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.00

    The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.

  • CVE-2012-1472Mar 13, 2012
    VMware
    Vcenter Chargeback Manager
    risk 0.00cvss —epss 0.02

    VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors.

  • CVE-2012-0903Jan 20, 2012
    Zimbra
    Desktop
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Desktop 7.1.2 b10978 allow remote attackers to inject arbitrary web script or HTML via the (1) Username or (2) MailBox Name.

  • CVE-2011-3868Oct 7, 2011
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.

  • CVE-2011-2894Oct 4, 2011
    VMware
    Spring Framework
    risk 0.00cvss —epss 0.09

    Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1)…

  • CVE-2011-0527Aug 15, 2011
    VMware
    Tc Server
    risk 0.00cvss —epss 0.02

    VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored…

  • CVE-2011-2146Jun 6, 2011
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to determine the existence…

  • CVE-2011-2145Jun 6, 2011
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1, when a Solaris or FreeBSD guest OS is used,…

  • CVE-2011-1787Jun 6, 2011
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Race condition in mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to gain…

  • CVE-2011-1789May 9, 2011
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1 Update 1 does not have a digital signature, which might make it easier for…

  • CVE-2011-1788May 9, 2011
    VMware
    Vcenter Server
    risk 0.00cvss —epss 0.00

    vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors.

  • CVE-2011-0426May 9, 2011
    VMware
    Virtualcenter
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2011-1786May 3, 2011
    VMware
    Esx
    risk 0.00cvss —epss 0.03

    lsassd in Likewise Open /Enterprise 5.3 before build 7845, Open 6.0 before build 8325, and Enterprise 6.0 before build 178, as distributed in VMware ESXi 4.1 and ESX 4.1 and possibly other products, allows remote attackers to cause a denial of service (daemon crash) via an…

  • CVE-2011-1785May 3, 2011
    VMware
    Esx
    risk 0.00cvss —epss 0.03

    VMware ESXi 4.0 and 4.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (socket exhaustion) via unspecified network traffic.

  • CVE-2011-1681Apr 10, 2011
    VMware
    Open Virtual Machine Tools
    risk 0.00cvss —epss 0.00

    vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process…

  • CVE-2011-1126Apr 4, 2011
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7.1.4 build 385536 on Linux, might allow local users to gain privileges via a Trojan horse shared library in an unspecified directory.

  • CVE-2011-0355Feb 17, 2011
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    Cisco Nexus 1000V Virtual Ethernet Module (VEM) 4.0(4) SV1(1) through SV1(3b), as used in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, does not properly handle dropped packets, which allows guest OS users to cause a denial of service (ESX or ESXi host OS crash) by sending an…

  • CVE-2010-2928Feb 16, 2011
    VMware
    Vcenter Server
    risk 0.00cvss —epss 0.00

    The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file.

  • CVE-2010-4263Jan 18, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to…

  • CVE-2010-4526Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the…

  • CVE-2010-4573Dec 22, 2010
    VMware
    Esxi
    risk 0.00cvss —epss 0.03

    The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, which allows remote attackers to obtain access via an arbitrary username and password.

  • CVE-2010-4296Dec 6, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain…

  • CVE-2010-4295Dec 6, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to…

  • CVE-2010-4294Dec 6, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    The frame decompression functionality in the VMnc media codec in VMware Movie Decoder before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548, VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548 on Windows, VMware Player 2.5.x before 2.5.5…

  • CVE-2010-3700Oct 29, 2010
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

  • CVE-2010-3277Sep 28, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    The installer in VMware Workstation 7.x before 7.1.2 build 301548 and VMware Player 3.x before 3.1.2 build 301548 renders an index.htm file if present in the installation directory, which might allow local users to trigger unintended interpretation of web script or HTML by…

Page 20 of 23