Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
aaS. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0021.html
CVE ID: CVE-2020-3979 State: PUBLISHED Published: 2020-09-18T17:37:00 Last Updated: 2024-08-04T07:52:20.546Z Vendors: n/a Products: VMware InstallBuilder Problem Types: Uncontrolled Search Path Element Description: InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin users. While those plugins are not required, they are loaded if present, which could allow an attacker to plant a malicious library which could result in code execution with the security scope of the installer. Additional Analyst Notes: - CVE Program Container: References: - https://blog.installbuilder.com/2020/08/updates-and-
r. Additional Analyst Notes: - CVE Program Container: References: - https://blog.installbuilder.com/2020/08/updates-and-bug-fixes-with-version-2070.html
CVE ID: CVE-2020-3980 State: PUBLISHED Published: 2020-09-16T16:13:40 Last Updated: 2024-08-04T07:52:20.602Z Vendors: n/a Products: VMware Fusion Problem Types: Privilege escalation vulnerability Description: VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path. An attacker with normal user privileges may exploit this issue to trick an admin user into executing malicious code on the system where Fusion is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3981 State: PUBLISHED Published: 2020-10-20T16:08:56 Last Updated: 2024-08-04T07:52:20.441Z Vendors: n/a Products: VMware ESXi, Workstation, Fusion Problem Types: Out-of-bounds read vulnerability Description: VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds read vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process. Additional Analyst Notes: - CVE Program Container: References: - https:/
this issue to leak memory from the vmx process. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE ID: CVE-2020-3982 State: PUBLISHED Published: 2020-10-20T16:09:04 Last Updated: 2024-08-04T07:52:20.601Z Vendors: n/a Products: VMware ESXi, Workstation, Fusion Problem Types: Out-of-bounds write vulnerability Description: VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap. Additional Analyst
t this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE ID: CVE-2020-3984 State: PUBLISHED Published: 2020-11-24T15:34:49 Last Updated: 2024-08-04T07:52:20.502Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: SQL Injection Description: The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injection. An authenticated SD-WAN Orchestrator user may exploit a vulnerable API call using specially crafted SQL queries which may lead to unauthorized data access. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-3985 State: PUBLISHED Published: 2020-11-24T15:35:00 Last Updated: 2024-08-04T07:52:20.834Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: Information Disclosure Description: The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-3986 State: PUBLISHED Published: 2020-09-16T16:13:54 Last Updated: 2024-08-04T07:52:20.439Z Vendors: n/a Products: VMware Workstation and Horizon Client for Windows Problem Types: Multiple out-of-bounds read issues via Cortado ThinPrint Description: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMF Parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Addi
leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3987 State: PUBLISHED Published: 2020-09-16T16:14:01 Last Updated: 2024-08-04T07:52:20.473Z Vendors: n/a Products: VMware Workstation and Horizon Client for Windows Problem Types: Multiple out-of-bounds read issues via Cortado ThinPrint Description: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is i
ndition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3988 State: PUBLISHED Published: 2020-09-16T16:14:08 Last Updated: 2024-08-04T07:52:20.595Z Vendors: n/a Products: VMware Workstation and Horizon Client for Windows Problem Types: Multiple out-of-bounds read issues via Cortado ThinPrint Description: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.
r to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3989 State: PUBLISHED Published: 2020-09-16T16:17:11 Last Updated: 2024-08-04T07:52:20.600Z Vendors: n/a Products: VMware Workstation and Horizon Client for Windows Problem Types: Denial-of-service vulnerability via Cortado ThinPrint Description: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-bounds write issue in Cortado ThinPrint component. A malicious actor with normal access to a virtual machine may be able to exploit this issue to create a partial denial-of-service condition on the system where Workstation or Horizon Client for Windows is installed. Exploitation is only possible if v
condition on the system where Workstation or Horizon Client for Windows is installed. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon Client. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3990 State: PUBLISHED Published: 2020-09-16T16:17:17 Last Updated: 2024-08-04T07:52:20.351Z Vendors: n/a Products: VMware Workstation and Horizon Client for Windows Problem Types: Information disclosure vulnerability via Cortado ThinPrint Description: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in Cortado ThinPrint component. A malicious actor with normal access to a virtual machine may be able to exploit this issue to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed. Exploitation is only possible i
cess running on the system where Workstation or Horizon Client for Windows is installed. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon Client. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0020.html
CVE ID: CVE-2020-3991 State: PUBLISHED Published: 2020-10-16T13:15:22 Last Updated: 2024-08-04T07:52:20.583Z Vendors: n/a Products: VMware Horizon Client for Windows Problem Types: Denial-of-service vulnerability Description: VMware Horizon Client for Windows (5.x before 5.5.0) contains a denial-of-service vulnerability due to a file system access control issue during install time. Successful exploitation of this issue may allow an attacker to overwrite certain admin privileged files through a symbolic link attack at install time. This will result into a denial-of-service condition on the machine where Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container
ondition on the machine where Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0022.html
CVE ID: CVE-2020-3992 State: PUBLISHED Published: 2020-10-20T16:11:13.000Z Last Updated: 2025-10-21T23:35:35.278Z Vendors: n/a Products: VMware ESXi Problem Types: Remote code execution vulnerability Description: OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advis
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html - https://www.zerodayinitiative.com/advisories/ZDI-20-1377/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1385/
CVE ID: CVE-2020-3993 State: PUBLISHED Published: 2020-10-20T16:11:19 Last Updated: 2024-08-04T07:52:20.557Z Vendors: n/a Products: VMware NSX-T Problem Types: MITM vulnerability Description: VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. A malicious actor with MITM positioning may be able to exploit this issue to compromise the transport node. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE ID: CVE-2020-3994 State: PUBLISHED Published: 2020-10-20T16:14:24 Last Updated: 2024-08-04T07:52:20.505Z Vendors: n/a Products: vCenter Server Problem Types: Session hijack vulnerability Description: VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates. Additional Analyst Notes: - CVE Program Container: References:
anagement Interface is used to download vCenter updates. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE ID: CVE-2020-3995 State: PUBLISHED Published: 2020-10-20T16:14:34 Last Updated: 2024-08-04T07:52:20.561Z Vendors: n/a Products: VMware ESXi, Workstation, Fusion Problem Types: Memory leak vulnerability Description: In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to trigger a memory leak issue resulting in memory resource exhaustion on the hypervisor if the attack is sustained for extended periods of time. Additional Analyst Notes: - CVE Program
tion on the hypervisor if the attack is sustained for extended periods of time. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE ID: CVE-2020-3996 State: PUBLISHED Published: 2020-10-22T20:18:07 Last Updated: 2024-08-04T07:52:20.347Z Vendors: n/a Products: Velero Problem Types: Information leakage due to incorrect volume assignment Description: Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vmware-tanzu/velero/security/advisories/GHSA-72xg-3mcq-52v4
CVE ID: CVE-2020-3997 State: PUBLISHED Published: 2020-10-23T13:49:06 Last Updated: 2024-08-04T07:52:20.334Z Vendors: n/a Products: VMware Horizon Server Problem Types: VMware Horizon Server Cross Site Scripting (XSS) vulnerability Description: VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0024.html
CVE ID: CVE-2020-3998 State: PUBLISHED Published: 2020-10-23T13:49:50 Last Updated: 2024-08-04T07:52:20.577Z Vendors: n/a Products: VMware Horizon Client for Windows Problem Types: VMware Horizon Client for Windows information disclosure vulnerability Description: VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0024.html
CVE ID: CVE-2020-3999 State: PUBLISHED Published: 2020-12-21T15:14:08 Last Updated: 2024-08-04T07:52:20.757Z Vendors: n/a Products: VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation Problem Types: Denial-of-Service Vulnerability Description: VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of serv
ormal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0029.html
CVE ID: CVE-2020-4000 State: PUBLISHED Published: 2020-11-24T15:35:07 Last Updated: 2024-08-04T07:52:20.546Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: Directory traversal Description: The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orchestrator user is able to traversal directories which may lead to code execution of files. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-4001 State: PUBLISHED Published: 2020-11-24T15:29:22 Last Updated: 2024-08-04T07:52:20.799Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: Heap buffer-overflow vulnerability Description: The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-4002 State: PUBLISHED Published: 2020-11-24T15:29:29 Last Updated: 2024-08-04T07:52:20.535Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: Insufficient input validation Description: The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way. An authenticated SD-WAN Orchestrator user with high privileges may be able to execute arbitrary code on the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-4003 State: PUBLISHED Published: 2020-11-24T15:29:38 Last Updated: 2024-08-04T07:52:20.837Z Vendors: n/a Products: VMware SD-WAN Orchestrator Problem Types: SQL-injection Description: VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attacks allowing for potential information disclosure. An authenticated SD-WAN Orchestrator user may inject code into SQL queries which may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2020-0025.html
CVE ID: CVE-2020-4004 State: PUBLISHED Published: 2020-11-20T19:06:28 Last Updated: 2024-08-04T07:52:20.492Z Vendors: n/a Products: VMware ESXi, Workstation, Fusion Problem Types: Use-after-free vulnerability Description: VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Additional Analyst Notes: - CVE Program Container: References: -
the virtual machine's VMX process running on the host. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0026.html
CVE ID: CVE-2020-4005 State: PUBLISHED Published: 2020-11-20T19:06:25 Last Updated: 2024-08-04T07:52:20.623Z Vendors: n/a Products: VMware ESXi Problem Types: Privilege escalation vulnerability Description: VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004) Additional Analyst Notes: - CVE Program C
is only possible when chained with another vulnerability (e.g. CVE-2020-4004) Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0026.html
CVE ID: CVE-2020-4006 State: PUBLISHED Published: 2020-11-23T21:22:40.000Z Last Updated: 2025-10-21T23:35:32.373Z Vendors: n/a Products: VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager Problem Types: Command Injection Description: VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VM
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2020-0027.html
CVE ID: CVE-2020-4008 State: PUBLISHED Published: 2020-12-16T14:17:31 Last Updated: 2024-08-04T07:52:20.711Z Vendors: n/a Products: VMware Carbon Black Cloud macOS Sensor Problem Types: VMware Carbon Black Cloud macOS Sensor installer file overwrite issue Description: The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which a macOS sensor is going to be installed, may overwrite a limited number of files with output from the sensor installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-002
dditional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0028.html
CVE ID: CVE-2020-4013 State: PUBLISHED Published: 2020-06-01T06:35:29.971325Z Last Updated: 2024-09-16T20:36:58.765Z Vendors: Atlassian Products: Crucible, Fisheye Problem Types: Cross Site Scripting (XSS) Description: The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7282 - https://jira.atlassian.com/browse/CRUC-8466
CVE ID: CVE-2020-4014 State: PUBLISHED Published: 2020-06-01T06:35:30.470268Z Last Updated: 2024-09-17T03:23:41.066Z Vendors: Atlassian Products: Crucible, Fisheye Problem Types: Improper Authorization Description: The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7283 - https://jira.atlassian.com/browse/CRUC-8467
CVE ID: CVE-2020-4015 State: PUBLISHED Published: 2020-06-01T06:35:31.031124Z Last Updated: 2024-09-16T18:09:13.525Z Vendors: Atlassian Products: Crucible, Fisheye Problem Types: Information Disclosure Description: The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7284 - https://jira.atlassian.com/browse/CRUC-8468