VMware ESXi 7.0 Update 3

CPE Details

VMware ESXi 7.0 Update 3
vmware
esxi
7.0
2022-02-22
19h07 +00:00
2023-08-30
10h55 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*

Informations

Vendor

vmware

Product

esxi

Version

7.0

Update

update_3

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-37085 2024-06-25 14h16 +00:00 VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
7.2
High
CVE-2024-22273 2024-05-21 17h29 +00:00 The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues.
8.1
High
CVE-2024-22252 2024-03-05 17h57 +00:00 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
9.3
Critical
CVE-2021-22050 2022-02-16 15h37 +00:00 ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.
7.5
High
CVE-2021-22043 2022-02-16 15h37 +00:00 VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files.
7.5
High
CVE-2021-22041 2022-02-16 15h37 +00:00 VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
6.7
Medium
CVE-2021-22042 2022-02-16 15h37 +00:00 VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
7.8
High
CVE-2021-22040 2022-02-16 15h37 +00:00 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
6.7
Medium