Vsphere vulnerabilitiesRanked by how likely they are to be used.
Vsphere is made by VMware. We track 61 published vulnerabilities listed under that exact name, across 7 versions. None of them is on the list of flaws known to be exploited today. VMware lists newer releases under their own names, such as Vsphere Data Protection, so check those pages too.
We keep watching the known-exploited list.
Is Vsphere listed under other names? Yes.
VMware also lists Vsphere under more specific names, such as Vsphere Data Protection and Vsphere Client. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Vsphere vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Vsphere's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Vsphere flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 4.4%CVE-2020-27216High
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that...
- 1.9%CVE-2012-1512Medium
Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a...
- 0.4%CVE-2021-1063High
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overread, which in turn may cause tampering of data, information disclosure, or...
- 0.4%CVE-2021-1059High
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn may cause tampering of data, information disclosure, or...
- 0.4%CVE-2021-1065High
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service.
- 0.3%CVE-2021-1060High
NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, which may lead to tampering of data or denial of service.
- 0.3%CVE-2021-1064High
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer, which may lead to...
- 0.3%CVE-2021-1058High
NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, which may lead to tampering of data or denial of service.
- 0.3%CVE-2021-1057High
NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the guest is not authorized, which may lead to integrity and...
- 0.3%CVE-2021-1062High
NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering of data or denial of service.
Running Vsphere? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
- Matched to
- Vsphere on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 61 published vulnerabilities listed under the name Vsphere, across 7 versions.
None of Vsphere's vulnerabilities is on the list of flaws known to be exploited today.
VMware also lists Vsphere under more specific names, such as Vsphere Data Protection and Vsphere Client. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Vsphere. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.