CVE-2021-22012

The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...

CVE-2021-22011

vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation...

CVE-2021-22011

CVE-2021-22011 describes an unauthenticated API endpoint vulnerability in VMware vCenter Server Content Library that allows a remote attacker with network access to port 443 to perform unauthenticated VM network setting manipulation. The issue is triggered by an unauthenticated API surface in vCe...

CVE-2021-22010

The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service...

CVE-2021-22010

CVE-2021-22010 affects VMware vCenter Server: DoS caused by VPXD memory exhaustion when an attacker with network access to port 443 exploits a vulnerability in VPXD. Affected product scope includes vCenter Server deployments that expose VPXD on 443, leading to degraded service or denial of servic...

CVE-2021-22009

CVE-2021-22009 affects VMware vCenter Server via VAPI, enabling a remote attacker to trigger a DoS through excessive memory consumption in the VAPI service when accessing port 443. Public sources (NVD/Red Hat CNVD) describe multiple memory‑exhaustion DoS vulnerabilities in VAPI/VAPI endpoints. Th...

CVE-2021-22009

The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI vCenter API service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service...

CVE-2021-22008

The vCenter Server contains an information disclosure vulnerability in VAPI vCenter API service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information...

CVE-2021-22008

CVE-2021-22008 is an information-disclosure flaw in VMware vCenter Server’s VAPI service. With network access to port 443, an attacker can send a crafted json-rpc message to access sensitive data. Public references (NVD/Red Hat/CNVD) describe the vulnerability similarly and cite VMware’s VMSA-202...

CVE-2021-22007

CVE-2021-22007 affects VMware vCenter Server in the Analytics service. An authenticated user with non-administrative privileges can disclose sensitive information via a local information disclosure vulnerability in Analytics. The issue is classified with CVSSv3.1 base score 5.5 (vector: CVSS:3.1/...

CVE-2021-22007

The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information...

CVE-2021-22006

VMware vCenter Server CVE-2021-22006 is a reverse proxy/bypass vulnerability arising from how the URI is handled, allowing an unauthenticated attacker with network access to port 443 to access restricted endpoints. Publicly documented details in multiple sources (NVD, CNVD, CVE lists, IBM/NCSC ad...

CVE-2021-22005

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file...

CVE-2021-22005

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file...

CVE-2021-22005

CVE-2021-22005 affects VMware vCenter Server via an arbitrary file upload vulnerability in the Analytics service. With network access to port 443, an attacker can upload a crafted file to trigger remote code execution. Public PoCs and exploits exist (e.g., VM attack surfaces and multiple advisori...

CVE-2021-21993

CVE-2021-21993 describes a Server-Side Request Forgery (SSRF) in VMware vCenter Server Content Library. An authorised user with content library access can trigger a POST request to vCenter Server, causing information disclosure. Affected ecosystem includes VMware vCenter Server versions vulnerabl...

CVE-2021-21993

The vCenter Server contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosur...

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. Recent assessments: Assessed...

CVE-2021-22005

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. Recent assessments: wvu-r7 at September...

CVE-2021-22015

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance...