VMware Photon OS vulnerabilities

4 CVEs affecting VMware Photon OS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22942, published 2023-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22942, published 2023-12-13. High severity, CVSS 7.8. EPSS: 2.6% chance of exploitation in the next 30 days. The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
CVE-2016-5333, published 2016-08-31. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
CVE-2020-10713, published 2020-07-30. High severity, CVSS 8.2. EPSS: 1.7% chance of exploitation in the next 30 days. A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections.…
CVE-2021-22055, published 2022-04-11. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries.