CVE-2021-21991: Undefined Security Weakness

The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client HTML5 or vCenter Serve...

PT-2021-4350

Name of the Vulnerable Software and Affected Versions vCenter Server affected versions not specified Description The vCenter Server contains a denial-of-service issue due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client HTM...

PT-2021-4352

Name of the Vulnerable Software and Affected Versions VMware vCenter Server affected versions not specified Description The issue is related to insufficient validation of session tokens in VMware vCenter Server, allowing a malicious actor with non-administrative user access on the vCenter Server...

CVE-2021-21985: Server-Side Request Forgery (SSRF)

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21986: Missing Authentication for Critical Function

The vSphere Client HTML5 contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform...

PT-2021-3175

Name of the Vulnerable Software and Affected Versions vSphere Client HTML5 affected versions not specified Description The issue concerns a vulnerability in the vSphere authentication mechanism for certain plug-ins, including Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and...

CVE-2021-21973

The vSphere Client HTML5 contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information...

CVE-2021-21972: Improper Limitation of a Pathname to a Restricted Directory

The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects...

CVE-2021-21973: Server-Side Request Forgery (SSRF)

The vSphere Client HTML5 contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information...