VMware Virtualcenter vulnerabilities

10 CVEs affecting VMware Virtualcenter, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-1405, published 2013-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0778, published 2009-03-12. High severity, CVSS 7.1. EPSS: 4.6% chance of exploitation in the next 30 days. The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka…
CVE-2013-1405, published 2013-02-15. High severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi…
CVE-2010-1137, published 2010-04-01. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows remote attackers to…
CVE-2010-0686, published 2010-04-01. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via…
CVE-2011-0426, published 2011-05-09. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read…
CVE-2008-3514, published 2008-08-13. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user…
CVE-2009-2277, published 2010-04-01. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or HTML via vectors…
CVE-2006-5990, published 2006-11-21. Medium severity, CVSS 4.0. EPSS: 0.9% chance of exploitation in the next 30 days. VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509…
CVE-2009-1072, published 2009-03-25. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a…
CVE-2008-4278, published 2008-10-06. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. VMware VirtualCenter 2.5 before Update 3 build 119838 on Windows displays a user's password in cleartext when the password contains unspecified special characters, which allows physically proximate…