CVE-2021-22040: Use After Free

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host...

Vulnerabilities fixed in VMware Workstation, Fusion & ESXi

VMware has fixed several vulnerabilities in various products, namely Workstation Pro/Player, Fusion and ESXi. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution User right...

CVE-2021-22042: Incorrect Authorization

VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user...

Vulnerability fixed in VMware NSX Edge

A vulnerability has been fixed in VMware NSX Edge. A authenticated malicious person with SSH access could potentially execute arbitrary commands on the underlying system with root privileges. Although this product is typically connected to a publicly accessible network, it is good practice to mak...

CVE-2022-22945: Improper Neutralization of Special Elements used in an OS Command

VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root...

CVE-2021-22043: Time-of-check Time-of-use (TOCTOU) Race Condition

VMware ESXi contains a TOCTOU Time-of-check Time-of-use vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files...

PT-2022-2229

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description The issue is related to a TOCTOU Time-of-check Time-of-use vulnerability in the handling of temporary files. This can be exploited by a malicious actor with access to settingsd to escalat...

Multiple VMware product resource management error vulnerabilities

VMware ESXi is a server virtualization platform that can be installed directly on physical servers.VMware Workstation is a set of virtual machine software.Vmware VMware Fusion is a product of Vmware, Inc. VMware Fusion is a suite of virtual machine software designed to run Windows applications on...

Vmware Cloud Foundation has a vulnerability related to input validation.

Vmware VMware Cloud Foundation is an all-in-one hybrid cloud platform from Vmware. The platform includes features such as operations automation, infrastructure auto-configuration, and integrated lifecycle management. An input validation error vulnerability exists in Vmware Cloud Foundation, which...

VMware ESXi race condition vulnerability

Vmware VMware ESXi is a server virtualization platform from Vmware that can be installed directly on physical servers. A Competing Conditions Issue vulnerability exists in VMware ESXi, which stems from a double fetch vulnerability in the product's UHCI USB controller. A remote user with...

PT-2022-2234

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description The issue is related to an unauthorized access vulnerability in VMware ESXi due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX...

VMware NSX-T operating system command injection vulnerability

Vmware NSX Data Center is a complete L2-L7 network and security virtualization platform from Vmware that provides virtualized networks for virtual machines, isolates virtual machines from the physical network, and makes network services independent of specific physical network devices, giving use...

PT-2022-2233

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description The issue is related to a slow HTTP POST denial-of-service vulnerability in the rhttpproxy service. A malicious actor with network access to ESXi can exploit this issue to create a...

PT-2022-2235

Name of the Vulnerable Software and Affected Versions VMware ESXi, Workstation, and Fusion affected versions not specified Description The issue is related to a double-fetch vulnerability in the UHCI USB controller of VMware's virtualization platform. This vulnerability can be exploited by a...

PT-2022-2237

Name of the Vulnerable Software and Affected Versions VMware NSX Edge affected versions not specified Description The issue is related to a CLI shell injection vulnerability in VMware NSX Edge. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the...

KLA12466 Multiple vulnerabilities in VMware Workstation

Multiple vulnerabilities were found in VMware Workstation. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in XHCI USB controller can be exploited to cause denial of...

Vmware Cloud Foundation Resource Management Vulnerability

Vmware VMware Cloud Foundation is an all-in-one hybrid cloud platform from Vmware. The platform includes features such as operations automation, infrastructure auto-configuration, and integrated lifecycle management. A resource management error vulnerability exists in Vmware Cloud Foundation, whi...

VMWare Cloud Foundation (ESXi) Access Control Vulnerability

Vmware VMware Cloud Foundation is an all-in-one hybrid cloud platform from Vmware. The platform includes features such as operations automation, infrastructure auto-configuration, and integrated lifecycle management. An access control error vulnerability exists in VMWare Cloud Foundation ESXi tha...

VMSA-2022-0005:VMware NSX Data Center for vSphere update addresses CLI shell injection vulnerability

Advisory ID: VMSA-2022-0005.2 CVSSv3 Range: 8.8 Issue Date:2022-02-15 Updated On: 2022-04-07 CVEs: CVE-2022-22945 Synopsis: VMware NSX Data Center for vSphere update addresses CLI shell injection vulnerability CVE-2022-22945 RSS Feed Download PDF Download Text File Share this page on social media...

PT-2022-1601

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified VMware Workstation affected versions not specified VMware Fusion affected versions not specified VMware Cloud Foundation affected versions not specified Description A use-after-free vulnerability...