VMware Vsphere Client vulnerabilities

4 CVEs affecting VMware Vsphere Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-7458, published 2016-12-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-1209, published 2014-04-11. High severity, CVSS 9.3. EPSS: 3.8% chance of exploitation in the next 30 days. VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution…
CVE-2013-1405, published 2013-02-15. High severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi…
CVE-2016-7458, published 2016-12-29. Medium severity, CVSS 5.8. EPSS: 1.2% chance of exploitation in the next 30 days. VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in…
CVE-2014-1210, published 2014-04-11. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted…