[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHjAa6ZGc3kAu2dGr_Jricil85PA3xXG4QQ3mzbZmqzw":3,"g5a-family:vmware\u002Fvcenter_server":208,"g5a-ex:vmware\u002Fvcenter_server@*":212},{"success":4,"data":5},true,{"product":6,"versions":58,"topVulnerabilitiesByEpss":75,"kevVulnerabilities":128,"seoMetadata":186,"meta":205},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":57},"vmware","vcenter_server",16,75,11,"2024-09-17",[14,19,22,24,27,29,31,33,36,38,40,43,45,48,52,55],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"4.0",5,0,false,{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},"4.0.0.10021",1,{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},"4.0.0.12305",{"version":25,"cve_count":26,"kev_count":17,"has_kev":18},"4.1",4,{"version":28,"cve_count":21,"kev_count":17,"has_kev":18},"4.1.0.12319",{"version":30,"cve_count":21,"kev_count":17,"has_kev":18},"4.1.0.14766",{"version":32,"cve_count":21,"kev_count":17,"has_kev":18},"4.1.0.17435",{"version":34,"cve_count":35,"kev_count":17,"has_kev":18},"5.0",9,{"version":37,"cve_count":17,"kev_count":17,"has_kev":18},"5.0.0.16964",{"version":39,"cve_count":16,"kev_count":17,"has_kev":18},"5.1",{"version":41,"cve_count":42,"kev_count":17,"has_kev":18},"5.5",10,{"version":44,"cve_count":35,"kev_count":17,"has_kev":18},"6.0",{"version":46,"cve_count":47,"kev_count":16,"has_kev":4},"6.5",34,{"version":49,"cve_count":50,"kev_count":51,"has_kev":4},"6.7",37,7,{"version":53,"cve_count":54,"kev_count":35,"has_kev":4},"7.0",39,{"version":56,"cve_count":11,"kev_count":26,"has_kev":4},"8.0","Vcenter Server by Vmware is a technology product with 16 tracked versions and 75 known security vulnerabilities including 11 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},{"version":25,"cve_count":26,"kev_count":17,"has_kev":18},{"version":28,"cve_count":21,"kev_count":17,"has_kev":18},{"version":30,"cve_count":21,"kev_count":17,"has_kev":18},{"version":32,"cve_count":21,"kev_count":17,"has_kev":18},{"version":34,"cve_count":35,"kev_count":17,"has_kev":18},{"version":37,"cve_count":17,"kev_count":17,"has_kev":18},{"version":39,"cve_count":16,"kev_count":17,"has_kev":18},{"version":41,"cve_count":42,"kev_count":17,"has_kev":18},{"version":44,"cve_count":35,"kev_count":17,"has_kev":18},{"version":46,"cve_count":47,"kev_count":16,"has_kev":4},{"version":49,"cve_count":50,"kev_count":51,"has_kev":4},{"version":53,"cve_count":54,"kev_count":35,"has_kev":4},{"version":56,"cve_count":11,"kev_count":26,"has_kev":4},[76,84,88,93,98,103,109,115,119,123],{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":83},"CVE-2021-21985","The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.","2021-05-26",9.8,"v3.1","Critical",0.99999,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":83},"CVE-2021-22005","The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.","2021-09-23",{"cveId":89,"description":90,"publishedDate":91,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":92},"CVE-2021-21972","The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).","2021-02-24",0.99865,{"cveId":94,"description":95,"publishedDate":96,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":97},"CVE-2023-34048","vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.","2023-10-25",0.99428,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":102},"CVE-2020-3952","Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.","2020-04-10",0.90384,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":42,"cvssVersion":107,"severity":82,"isKev":18,"epssScore":108},"CVE-2015-2342","The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.","2015-10-12","v2",0.89048,{"cveId":110,"description":111,"publishedDate":91,"cvssScore":112,"cvssVersion":81,"severity":113,"isKev":4,"epssScore":114},"CVE-2021-21973","The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).",5.3,"Medium",0.88012,{"cveId":116,"description":117,"publishedDate":12,"cvssScore":80,"cvssVersion":81,"severity":82,"isKev":4,"epssScore":118},"CVE-2024-38812","The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.",0.54571,{"cveId":120,"description":121,"publishedDate":87,"cvssScore":112,"cvssVersion":81,"severity":113,"isKev":4,"epssScore":122},"CVE-2021-22017","Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.",0.49177,{"cveId":124,"description":125,"publishedDate":126,"cvssScore":112,"cvssVersion":81,"severity":113,"isKev":18,"epssScore":127},"CVE-2022-31698","The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.","2022-12-13",0.47795,[129,138,148,151,160,164,169,173,177,180,183],{"cveId":130,"description":131,"publishedDate":132,"cvssScore":80,"severity":82,"isKev":4,"epssScore":133,"cisaVulnName":134,"cisaDateAdded":135,"cisaShortDescription":136,"cisaRequiredAction":137},"CVE-2024-37079","vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.","2024-06-18",0.22377,"Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability","2026-01-23","Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":139,"description":140,"publishedDate":12,"cvssScore":141,"severity":142,"isKev":4,"epssScore":143,"cisaVulnName":144,"cisaDateAdded":145,"cisaShortDescription":146,"cisaRequiredAction":147},"CVE-2024-38813","The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.",7.5,"High",0.17355,"VMware vCenter Server Privilege Escalation Vulnerability","2024-11-20","VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":116,"description":117,"publishedDate":12,"cvssScore":80,"severity":82,"isKev":4,"epssScore":118,"cisaVulnName":149,"cisaDateAdded":145,"cisaShortDescription":150,"cisaRequiredAction":147},"VMware vCenter Server Heap-Based Buffer Overflow Vulnerability","VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.",{"cveId":152,"description":153,"publishedDate":154,"cvssScore":155,"severity":113,"isKev":4,"epssScore":156,"cisaVulnName":157,"cisaDateAdded":158,"cisaShortDescription":159,"cisaRequiredAction":147},"CVE-2022-22948","The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.","2022-03-29",6.5,0.13282,"VMware vCenter Server Incorrect Default File Permissions Vulnerability ","2024-07-17","VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.",{"cveId":94,"description":95,"publishedDate":96,"cvssScore":80,"severity":82,"isKev":4,"epssScore":97,"cisaVulnName":161,"cisaDateAdded":162,"cisaShortDescription":163,"cisaRequiredAction":147},"VMware vCenter Server Out-of-Bounds Write Vulnerability","2024-01-22","VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.",{"cveId":110,"description":111,"publishedDate":91,"cvssScore":112,"severity":113,"isKev":4,"epssScore":114,"cisaVulnName":165,"cisaDateAdded":166,"cisaShortDescription":167,"cisaRequiredAction":168},"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","2022-03-07","VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.","Apply updates per vendor instructions.",{"cveId":120,"description":121,"publishedDate":87,"cvssScore":112,"severity":113,"isKev":4,"epssScore":122,"cisaVulnName":170,"cisaDateAdded":171,"cisaShortDescription":172,"cisaRequiredAction":168},"VMware vCenter Server Improper Access Control","2022-01-10","Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.",{"cveId":99,"description":100,"publishedDate":101,"cvssScore":80,"severity":82,"isKev":4,"epssScore":102,"cisaVulnName":174,"cisaDateAdded":175,"cisaShortDescription":176,"cisaRequiredAction":168},"VMware vCenter Server Information Disclosure Vulnerability","2021-11-03","VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.",{"cveId":85,"description":86,"publishedDate":87,"cvssScore":80,"severity":82,"isKev":4,"epssScore":83,"cisaVulnName":178,"cisaDateAdded":175,"cisaShortDescription":179,"cisaRequiredAction":168},"VMware vCenter Server File Upload Vulnerability","VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.",{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"severity":82,"isKev":4,"epssScore":83,"cisaVulnName":181,"cisaDateAdded":175,"cisaShortDescription":182,"cisaRequiredAction":168},"VMware vCenter Server Improper Input Validation Vulnerability","VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.",{"cveId":89,"description":90,"publishedDate":91,"cvssScore":80,"severity":82,"isKev":4,"epssScore":92,"cisaVulnName":184,"cisaDateAdded":175,"cisaShortDescription":185,"cisaRequiredAction":168},"VMware vCenter Server Remote Code Execution Vulnerability","VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.",{"title":187,"metaDescription":188,"keywords":189,"structuredData":190},"Vcenter Server by Vmware - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Vcenter Server by Vmware covering 16 versions with 75 tracked vulnerabilities including 7 critical and 1 high-severity issues and 11 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Vcenter Server vulnerabilities, Vcenter Server security, Vcenter Server CVE, Vmware Vcenter Server, Vcenter Server threat intelligence, Vmware security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Vcenter Server KEV, Vcenter Server exploited vulnerabilities",{"@context":191,"@type":192,"name":193,"description":188,"url":194,"manufacturer":195,"applicationCategory":199,"softwareVersion":200,"mainEntity":201},"https:\u002F\u002Fschema.org","SoftwareApplication","Vcenter Server","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fvmware\u002Fvcenter_server",{"@type":196,"name":197,"url":198},"Organization","Vmware","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fvmware","Security Software","16 versions tracked",{"@type":202,"name":203,"description":204,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Vcenter Server Security Vulnerabilities","Security vulnerabilities affecting Vcenter Server by Vmware",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":206,"apiVersion":207},"2026-10-17T17:21:27.225Z","3.0",[209],{"product":210,"cves":211},"vcenter_server_appliance",14,{"rows":213,"total":11,"capped":18,"failed":17},[214,259,268,272,318,323,327,331,335,339,343],{"cveId":130,"name":134,"severity":82,"cvss":80,"added":135,"epss":133,"published":215,"ranges":216,"checked":4,"hits":258,"covers":18},"2024-06-18T06:15:11.35",[217,218,53,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,56,248,249,250,251,252,253,254,255,256,257],"7.0-a","7.0-b","7.0-c","7.0-d","7.0-update1a","7.0-update1","7.0-update1c","7.0-update1d","7.0-update2a","7.0-update2b","7.0-update2","7.0-update2c","7.0-update2d","7.0-update3a","7.0-update3","7.0-update3c","7.0-update3d","7.0-update3e","7.0-update3f","7.0-update3g","7.0-update3h","7.0-update3i","7.0-update3j","7.0-update3k","7.0-update3l","7.0-update3m","7.0-update3n","7.0-update3o","7.0-update3p","8.0-a","8.0-b","8.0-c","8.0-update1a","8.0-update1b","8.0-update1","8.0-update1c","8.0-update1d","8.0-update2a","8.0-update2b","8.0-update2","8.0-update2c",[],{"cveId":139,"name":144,"severity":142,"cvss":141,"added":145,"epss":143,"published":260,"ranges":261,"checked":4,"hits":267,"covers":18},"2024-09-17T18:15:04.127",[217,218,53,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,262,263,264,246,247,56,248,249,250,251,252,253,265,254,255,256,257,266],"7.0-update3q","7.0-update3r","7.0-update3s","8.0-update1e","8.0-update2d",[],{"cveId":116,"name":149,"severity":82,"cvss":80,"added":145,"epss":118,"published":269,"ranges":270,"checked":4,"hits":271,"covers":18},"2024-09-17T18:15:03.92",[217,218,53,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,262,263,264,246,247,56,248,249,250,251,252,253,265,254,255,256,257,266],[],{"cveId":152,"name":157,"severity":113,"cvss":155,"added":158,"epss":156,"published":273,"ranges":274,"checked":4,"hits":317,"covers":18},"2022-03-29T18:15:08.04",[275,276,46,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,49,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,217,218,53,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"6.5-a","6.5-b","6.5-c","6.5-d","6.5-e","6.5-f","6.5-update1b","6.5-update1","6.5-update1c","6.5-update1d","6.5-update1e","6.5-update1g","6.5-update2b","6.5-update2","6.5-update2c","6.5-update2d","6.5-update2g","6.5-update3","6.5-update3d","6.5-update3f","6.5-update3k","6.5-update3n","6.5-update3p","6.5-update3q","6.7-a","6.7-b","6.7-d","6.7-update1b","6.7-update1","6.7-update2a","6.7-update2","6.7-update2c","6.7-update3a","6.7-update3b","6.7-update3m","6.7-update3","6.7-update3f","6.7-update3g","6.7-update3j","6.7-update3l","6.7-update3n","6.7-update3o",[],{"cveId":94,"name":161,"severity":82,"cvss":80,"added":162,"epss":97,"published":319,"ranges":320,"checked":4,"hits":322,"covers":18},"2023-10-25T18:17:27.897",[321,217,218,53,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,246,247,56,248,249,250,251,252],"4.0 to 5.5",[],{"cveId":110,"name":165,"severity":113,"cvss":112,"added":166,"epss":114,"published":324,"ranges":325,"checked":4,"hits":326,"covers":18},"2021-02-24T17:15:15.923",[275,276,46,277,278,279,280,284,285,286,287,288,289,290,291,292,293,294,295,299,300,49,301,302,303,304,305,306,307,308,310,311,312,313,217,218,53,219,220,221,222],[],{"cveId":120,"name":170,"severity":113,"cvss":112,"added":171,"epss":122,"published":328,"ranges":329,"checked":4,"hits":330,"covers":18},"2021-09-23T13:15:08.207",[49],[],{"cveId":99,"name":174,"severity":82,"cvss":80,"added":175,"epss":102,"published":332,"ranges":333,"checked":4,"hits":334,"covers":18},"2020-04-10T14:15:12",[49],[],{"cveId":85,"name":178,"severity":82,"cvss":80,"added":175,"epss":83,"published":336,"ranges":337,"checked":4,"hits":338,"covers":18},"2021-09-23T12:15:07.707",[46,49,53],[],{"cveId":77,"name":181,"severity":82,"cvss":80,"added":175,"epss":83,"published":340,"ranges":341,"checked":4,"hits":342,"covers":18},"2021-05-26T15:15:07.937",[275,276,46,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,299,300,49,301,302,303,304,305,306,307,308,309,310,311,312,313,314,217,218,53,219,220,221,222,223,224,225,227],[],{"cveId":89,"name":184,"severity":82,"cvss":80,"added":175,"epss":92,"published":344,"ranges":345,"checked":4,"hits":346,"covers":18},"2021-02-24T17:15:15.833",[275,276,46,277,278,279,280,284,285,286,287,288,289,290,291,292,293,294,295,299,300,49,301,302,303,304,305,306,307,308,310,311,312,313,217,218,53,219,220,221,222],[]]