VMware Vcloud Director vulnerabilities

5 CVEs affecting VMware Vcloud Director, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22966, published 2022-04-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-3956, published 2020-05-20. High severity, CVSS 8.8. EPSS: 21.1% chance of exploitation in the next 30 days. VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An…
CVE-2022-22966, published 2022-04-14. High severity, CVSS 7.2. EPSS: 6.6% chance of exploitation in the next 30 days. An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code execution vulnerability to gain access to…
CVE-2019-5523, published 2019-04-01. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may…
CVE-2016-2076, published 2016-04-15. High severity, CVSS 7.6. EPSS: 1.4% chance of exploitation in the next 30 days. Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles…
CVE-2014-1211, published 2014-01-17. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.