Vmware Vcenter Server vulnerabilities

CVE-2021-22048 [HIGH] CVE-2021-22048: The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Auth The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.

CVE-2021-22049 [CRITICAL] CWE-918 CVE-2021-22049: The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

CVE-2023-20892 [CRITICAL] CWE-787 CVE-2023-20892: The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory i The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.

CVE-2023-20893 [CRITICAL] CWE-416 CVE-2023-20893: The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERP The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.

CVE-2023-20895 [CRITICAL] CWE-787 CVE-2023-20895: The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DC The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.

CVE-2021-22006 [HIGH] CVE-2021-22006: The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.

CVE-2017-4919 [CRITICAL] CWE-306 CVE-2017-4919: VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.

CVE-2024-22274 [HIGH] CWE-94 CVE-2024-22274: The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.

CVE-2022-31698 [MEDIUM] CWE-400 CVE-2022-31698: The vCenter Server contains a denial-of-service vulnerability in the content library service. A mali The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.

CVE-2025-41225 [HIGH] CWE-78 CVE-2025-41225: The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

CVE-2014-4241 [MEDIUM] CVE-2014-4241: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related to WLS - Web Services.

CVE-2013-1405 [CRITICAL] CWE-287 CVE-2013-1405: VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMwar VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute a

CVE-2017-4921 [HIGH] CVE-2017-4921: VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs d VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation.

CVE-2025-41228 [MEDIUM] CWE-79 CVE-2025-41228: VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to imprope VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

CVE-2017-4923 [CRITICAL] CWE-200 CVE-2017-4923: VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This i VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.

CVE-2016-7459 [HIGH] CWE-611 CVE-2016-7459: VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read ar VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVE-2021-22008 [HIGH] CVE-2021-22008: The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.

CVE-2021-22014 [HIGH] CVE-2021-22014: The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.

CVE-2021-22012 [HIGH] CWE-306 CVE-2021-22012: The vCenter Server contains an information disclosure vulnerability due to an unauthenticated applia The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

CVE-2022-22982 [HIGH] CWE-918 CVE-2022-22982: The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor wi The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.