VMware Horizon vulnerabilities
6 CVEs affecting VMware Horizon, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22964, published 2022-04-11.
More from VMware.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2019-5513, published 2019-04-09. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of…
- CVE-2020-3997, published 2020-10-23. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which…
- CVE-2022-22938, published 2022-01-28. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in…
- CVE-2019-5527, published 2019-10-10. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated the severity of this issue to be in the Important severity…
- CVE-2022-22962, published 2022-04-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful…
- CVE-2022-22964, published 2022-04-11. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration file.