Advisories · Technology

VMware vCenter Server.

Every CVE that names VMware vCenter Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-41228 CVE record

CVSS 4.3 Medium

VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Cross-site scripting (XSS)
Not analysed yet 20 May 2025
CVE-2025-41225 CVE record

CVSS 8.8 High

VMware vCenter Server authenticated command-execution vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Command injection
Not analysed yet 20 May 2025
CVE-2024-38813 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

Privilege escalation vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Privilege escalation
- CWE-273
Not analysed yet 17 Sept 2024
CVE-2024-38812 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Heap-overflow vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 17 Sept 2024
CVE-2024-37081 CVE record

CVSS 7.8 High

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.
- VMware vCenter Server
- VMware Cloud Foundation
- CWE-556
Not analysed yet 18 Jun 2024
CVE-2024-37080 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Heap-based buffer overflow in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 18 Jun 2024
CVE-2024-37079 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Out-of-bounds write in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 18 Jun 2024
CVE-2024-22275 CVE record

CVSS 4.9 Medium

Information disclosure in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation (vCenter Server)
- Information disclosure
Not analysed yet 21 May 2024
CVE-2024-22274 CVE record

CVSS 7.2 High

Code injection in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation (vCenter Server)
- Code injection
Not analysed yet 21 May 2024
CVE-2023-34056 CVE record

CVSS 4.3 Medium

VMware vCenter Server Partial Information Disclosure Vulnerability
- VMware vCenter Server
- VMware Cloud Foundation (VMware vCenter Server)
- Information disclosure
Not analysed yet 25 Oct 2023
CVE-2023-34048 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

VMware vCenter Server Out-of-Bounds Write Vulnerability
- VMware vCenter Server
- VMware Cloud Foundation (VMware vCenter Server)
- Memory corruption
Not analysed yet 25 Oct 2023
CVE-2022-31680 CVE record

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).
- VMware vCenter Server
Not analysed yet 7 Oct 2022
CVE-2022-22982 CVE record

The vCenter Server contains a server-side request forgery (SSRF) vulnerability.
- VMware vCenter Server
Not analysed yet 13 Jul 2022
CVE-2021-22013 CVE record

The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API.
- VMware vCenter Server
Not analysed yet 23 Sept 2021
CVE-2021-22012 CVE record

The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API.
- VMware vCenter Server
Not analysed yet 23 Sept 2021
CVE-2021-21972 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Path traversal in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Path traversal
Not analysed yet 24 Feb 2021
CVE-2021-21973 CVE record

CVSS 5.3 MediumCritical · KEVKEV

Server-side request forgery in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Server-side request forgery (SSRF)
Not analysed yet 24 Feb 2021
CVE-2020-3952 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Missing authentication in VMware vCenter Server
- VMware vCenter Server
- Authentication bypass
Not analysed yet 10 Apr 2020
CVE-2019-5531 CVE record

VMware vSphere ESXi: VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG…
- VMware vSphere ESXi
- VMware vCenter Server
Not analysed yet 18 Sept 2019
CVE-2019-5532 CVE record

VMware vCenter Server: VMware vCenter Server (6.7.x prior to 6.7 U3…
- VMware vCenter Server
Not analysed yet 18 Sept 2019
CVE-2019-5534 CVE record

VMware vCenter Server: VMware vCenter Server (6.7.x prior to 6.7 U3…
- VMware vCenter Server
Not analysed yet 18 Sept 2019
CVE-2017-4927 CVE record

VMware vCenter Server: VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly…
- VMware vCenter Server
Not analysed yet 17 Nov 2017
CVE-2017-4926 CVE record

VMware vCenter Server: VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for…
- VMware vCenter Server
Not analysed yet 15 Sept 2017
CVE-2017-4919 CVE record

VMware vCenter Server: VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain…
- VMware vCenter Server
Not analysed yet 28 Jul 2017