Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20860 - https://security.netapp.com/advisory/ntap-20230505-0006/
CVE ID: CVE-2023-20861 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T15:38:17.844Z Vendors: n/a Products: Spring Framework Problem Types: Denial-of-service vulnerability Description: In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20861 - https://security.netapp.com/advisory/ntap-20230420-0007/
CVE ID: CVE-2023-20862 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T15:47:05.524Z Vendors: n/a Products: Spring Security Problem Types: Empty SecurityContext Is Not Properly Saved Upon Logout Description: In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the fo
nerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20862 - https://security.netapp.com/advisory/ntap-20230526-0002/
CVE ID: CVE-2023-20863 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:48:13.438Z Vendors: n/a Products: Spring Framework Problem Types: CWE-400 Description: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20863 - https://security.netapp.com/advisory/ntap-20240524-0015/
CVE ID: CVE-2023-20864 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:28:19.391Z Vendors: n/a Products: VMware Aria Operations for Logs (formerly vRealize Log Insight) Problem Types: VMware Aria Operations for Logs contains a deserialization vulnerability Description: VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0007.html
CVE ID: CVE-2023-20865 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:26:03.893Z Vendors: n/a Products: VMware Aria Operations for Logs (formerly vRealize Log Insight) Problem Types: VMware Aria Operations for Logs contains a command injection vulnerability Description: VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0007.html
CVE ID: CVE-2023-20866 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:41:34.511Z Vendors: n/a Products: Spring Session Problem Types: CWE-200 Description: In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20866
CVE ID: CVE-2023-20867 State: PUBLISHED Published: 2023-06-13T16:47:21.689Z Last Updated: 2025-10-21T23:05:46.160Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: VMware Products: VMware Tools Problem Types: CWE-287 Description: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0013.html - https://security.netapp.com/advisory/ntap-20230725-0001/ - https://lists.debian.org/debian-lts-announce/2023
0013.html - https://security.netapp.com/advisory/ntap-20230725-0001/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html - https://www.debian.org/security/2023/dsa-5493 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/ - http://www.openwall.com/lists/oss-security/2023/10/16/2 - http://www.openwall.com/lists/oss-security/2023/10/16/11
CVE ID: CVE-2023-20868 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-16T14:40:55.597Z Vendors: n/a Products: NSX-T Problem Types: Reflected cross-site scripting vulnerability Description: NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0010.html
CVE ID: CVE-2023-20869 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T17:15:06.088Z Vendors: n/a Products: VMware Workstation Pro / Player (Workstation) and VMware Fusion Problem Types: Stack-based buffer-overflow vulnerability in bluetooth device-sharing functionality Description: VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE ID: CVE-2023-20870 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T17:13:12.192Z Vendors: n/a Products: VMware Workstation Pro / Player (Workstation) and VMware Fusion Problem Types: Information disclosure vulnerability in bluetooth device-sharing functionality Description: VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE ID: CVE-2023-20871 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:52:33.588Z Vendors: n/a Products: VMware Fusion Problem Types: VMware Fusion Raw Disk local privilege escalation vulnerability Description: VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE ID: CVE-2023-20872 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:39:20.562Z Vendors: n/a Products: VMware Workstation Pro / Player (Workstation) and VMware Fusion Problem Types: Out-of-bounds read/write vulnerability Description: VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0008.html
CVE ID: CVE-2023-20873 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-05-05T16:06:07.713Z Vendors: n/a Products: Spring Boot Problem Types: Security Bypass with Spring Boot when deployed to Cloud Foundry Description: In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+. Additional Analyst Notes: - CVE Program Container: - CISA ADP
unsupported versions should upgrade to 3.0.6+ or 2.7.11+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20873 - https://security.netapp.com/advisory/ntap-20230601-0009/ - https://spring.io/blog/2023/05/18/spring-boot-2-5-15-and-2-6-15-available-now
CVE ID: CVE-2023-20877 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T18:06:05.127Z Vendors: n/a Products: VMware Aria Operations (formerly vRealize Operations) Problem Types: Privilege Escalation Vulnerability Description: VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CVE ID: CVE-2023-20878 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T18:02:14.568Z Vendors: n/a Products: VMware Aria Operations (formerly vRealize Operations) Problem Types: Deserialization Vulnerability Description: VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CVE ID: CVE-2023-20879 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T16:33:40.068Z Vendors: n/a Products: VMware Aria Operations (formerly vRealize Operations) Problem Types: Local Privilege Escalation Vulnerability Description: VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CVE ID: CVE-2023-20880 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T17:53:37.308Z Vendors: n/a Products: VMware Aria Operations (formerly vRealize Operations) Problem Types: Local Privilege Escalation Vulnerability Description: VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0009.html
CVE ID: CVE-2023-20881 State: PUBLISHED Published: 2023-05-19T00:00:00 Last Updated: 2025-01-21T20:04:58.397Z Vendors: n/a Products: Cloud Controller API Problem Types: CWE-295 Description: Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2023-20881-cas-for-syslog-drain-mtls-feature-can-be-overwritten/
CVE ID: CVE-2023-20882 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-16T14:39:05.654Z Vendors: n/a Products: Cloud Foundry Routing release Problem Types: CWE-400 Description: In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-p
VE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disconnect-resulting-in-dos/
CVE ID: CVE-2023-20883 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-16T14:37:39.057Z Vendors: n/a Products: Spring Boot Problem Types: CWE-400 Description: In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20883 - https://security.netapp.com/advisory/ntap-20230703-0008/
CVE ID: CVE-2023-20884 State: PUBLISHED Published: 2023-05-30T15:05:53.284Z Last Updated: 2025-01-10T18:58:11.000Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation) Problem Types: Insecure Redirect Vulnerability Description: VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program
main due to improper path handling leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0011.html
CVE ID: CVE-2023-20885 State: PUBLISHED Published: 2023-06-16T12:18:35.886Z Last Updated: 2024-12-16T20:05:19.504Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cloud Foundry, Cloud FOundry Products: Notifications, SMB-volume release, cf-nfs-volume release Description: Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
.0.27, 7.1.X versions prior to 7.1.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/
CVE ID: CVE-2023-20886 State: PUBLISHED Published: 2023-10-31T20:44:50.773Z Last Updated: 2024-09-12T19:58:57.003Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware Workspace ONE UEM Console Problem Types: CWE-601 Description: VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0025.html
CVE ID: CVE-2023-20887 State: PUBLISHED Published: 2023-06-07T14:16:56.641Z Last Updated: 2025-10-21T23:05:46.461Z Vendors: n/a Products: Aria Operations for Networks (Formerly vRealize Network Insight) Problem Types: Networks Command Injection Vulnerability Description: Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0012.html - http://packetstormsecurity.com/files/
nt: References: - https://www.vmware.com/security/advisories/VMSA-2023-0012.html - http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html
CVE ID: CVE-2023-20888 State: PUBLISHED Published: 2023-06-07T14:18:41.771Z Last Updated: 2025-01-07T14:56:37.775Z Vendors: n/a Products: Aria Operations for Networks (Formerly vRealize Network Insight) Problem Types: Networks Authenticated Deserialization Vulnerability Description: Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0012.html
CVE ID: CVE-2023-20889 State: PUBLISHED Published: 2023-06-07T14:20:14.452Z Last Updated: 2025-01-07T14:50:39.140Z Vendors: n/a Products: Aria Operations for Networks (Formerly vRealize Network Insight) Problem Types: Information Disclosure Vulnerability Description: Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0012.html
CVE ID: CVE-2023-20890 State: PUBLISHED Published: 2023-08-29T17:38:05.601Z Last Updated: 2024-10-01T20:33:53.451Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Aria Operations for Networks Problem Types: Arbitrary File Write Vulnerability Description: Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0018.
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0018.html
CVE ID: CVE-2023-20891 State: PUBLISHED Published: 2023-07-26T05:41:23.643Z Last Updated: 2024-10-21T13:07:34.980Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: VMware Tanzu Application Service for VMs, Isolation segment Problem Types: CWE-532 Description: The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default de
s can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0016.html
CVE ID: CVE-2023-20892 State: PUBLISHED Published: 2023-06-22T11:47:19.390Z Last Updated: 2025-02-13T16:39:51.341Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware vCenter Server (vCenter Server), VMware Cloud Foundation (vCenter Server) Description: The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
underlying operating system that hosts vCenter Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0014.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1801
CVE ID: CVE-2023-20893 State: PUBLISHED Published: 2023-06-22T11:52:32.771Z Last Updated: 2025-02-13T16:40:07.355Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware vCenter Server (vCenter Server), VMware Cloud Foundation (vCenter Server) Description: The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/se
ver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0014.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1799
CVE ID: CVE-2023-20894 State: PUBLISHED Published: 2023-06-22T11:54:04.383Z Last Updated: 2025-02-13T16:40:07.942Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware vCenter Server (vCenter Server), VMware Cloud Foundation (vCenter Server) Description: The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/secur
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0014.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1658