rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-21999 
VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege escalation vulnerability. An attacker with normal access to a virtual machine may exploit this issue by placing a malicious file renamed as `openssl.cnf' in an unrestricted directory which would allow code to be executed with elevated privileges.
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware Tools for Windows, VMware Remote Console for Windows and VMware App Volumes
Published: 2021-06-23T11:16:41.000Z
CVE-2021-22000 
VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.
Problem types: description: Uncontrolled Search Path Element (4.4) - CWE
Affected products: vendor: n/a
product: Vmware Thinapp
Published: 2021-07-13T18:01:34.000Z
CVE-2021-22001 
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Cloud Foundry UAA server
Published: 2021-07-22T13:17:35.000Z
CVE-2021-22002 
VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.
Problem types: description: Host header vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2021-08-31T21:02:21.000Z
CVE-2021-22003 
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access and Identity Manager
Published: 2021-08-31T21:02:31.000Z
CVE-2021-22004 
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
Problem types: description: Software manipulation
Affected products: vendor: n/a
product: Saltstack Salt
Published: 2021-09-08T15:00:14.000Z
CVE-2021-22005 
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
Problem types: description: File upload vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:37:30.000Z
CVE-2021-22006 
The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.
Problem types: description: Reverse proxy bypass vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:41:13.000Z
CVE-2021-22007 
The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.
Problem types: description: Local information disclosure vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:41:21.000Z
CVE-2021-22008 
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:41:28.000Z
CVE-2021-22009 
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service.
Problem types: description: Multiple denial of service vulnerabilities
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:51:32.000Z
CVE-2021-22010 
The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:51:40.000Z
CVE-2021-22011 
vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.
Problem types: description: Unauthenticated API endpoint vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:51:47.000Z
CVE-2021-22012 
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server
Published: 2021-09-23T11:58:46.000Z
CVE-2021-22013 
The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
Problem types: description: File path traversal vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server
Published: 2021-09-23T11:58:53.000Z
CVE-2021-22014 
The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.
Problem types: description: Authenticated code execution vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:59:00.000Z
CVE-2021-22015 
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
Problem types: description: Multiple local privilege escalation vulnerabilities
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T00:00:00.000Z
CVE-2021-22016 
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
Problem types: description: Reflected XSS vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T12:12:54.000Z
CVE-2021-22017 
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Problem types: description: Rhttpproxy bypass vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T12:13:01.000Z
CVE-2021-22018 
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
Problem types: description: File deletion vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T12:16:31.000Z
CVE-2021-22019 
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T12:16:41.000Z
CVE-2021-22020 
The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T12:16:47.000Z
CVE-2021-22021 
VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.
Problem types: description: Cross Site Scripting (XSS) vulnerability
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2021-08-30T18:06:13.000Z
CVE-2021-22022 
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure.
Problem types: description: Arbitrary file read vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:53:32.000Z
CVE-2021-22023 
The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover.
Problem types: description: Insecure direct object reference vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:53:35.000Z
CVE-2021-22024 
The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure.
Problem types: description: Arbitrary log-file read vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:53:37.000Z
CVE-2021-22025 
The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.
Problem types: description: Broken access control vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:54:41.000Z
CVE-2021-22026 
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
Problem types: description: Server Side Request Forgery
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:54:40.000Z
CVE-2021-22027 
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
Problem types: description: Server Side Request Forgery
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-08-30T17:54:40.000Z
CVE-2021-22028 
In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure from the file system. A malicious user can read/write information from the file system using this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: n/a
product: gpfdist (Greenplum)
Published: 2021-11-19T16:17:47.000Z
CVE-2021-22029 
VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE UEM console
Published: 2021-08-31T20:50:18.000Z
CVE-2021-22030 
In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with access to logs can read sensitive(credentials) information about users
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: n/a
product: GPDB (Greenplum database)
Published: 2021-11-19T16:04:46.000Z
CVE-2021-22033 
Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.
Problem types: description: SSRF
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-10-13T15:42:58.000Z
CVE-2021-22034 
Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations Tenant App for VMware Cloud Director
Published: 2021-10-21T19:35:10.000Z
CVE-2021-22035 
VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.
Problem types: description: CSV injection vulnerability in Log Insight
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2021-10-13T15:50:54.000Z
CVE-2021-22036 
VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.
Problem types: description: Open redirect vulnerability in vRealize Orchestrator
Affected products: vendor: n/a
product: VMware vRealize Orchestrator
Published: 2021-10-13T15:52:00.000Z
CVE-2021-22037 
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: VMware InstallBuilder
Published: 2021-10-29T11:09:07.000Z
CVE-2021-22038 
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: VMware InstallBuilder
Published: 2021-10-29T11:08:01.000Z
CVE-2021-22040 
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: n/a
product: VMware ESXi , Workstation, Fusion and VMware Cloud Foundation
Published: 2022-02-16T16:37:53.000Z
CVE-2021-22041 
VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Problem types: description: Double-fetch vulnerability
Affected products: vendor: n/a
product: VMware ESXi , Workstation, Fusion and VMware Cloud Foundation
Published: 2022-02-16T16:37:54.000Z
CVE-2021-22042 
VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
Problem types: description: Unauthorized access vulnerability
Affected products: vendor: n/a
product: VMware ESXi and VMware Cloud Foundation
Published: 2022-02-16T16:37:54.000Z
CVE-2021-22043 
VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files.
Problem types: description: TOCTOU vulnerability
Affected products: vendor: n/a
product: VMware ESXi and VMware Cloud Foundation
Published: 2022-02-16T16:37:55.000Z
CVE-2021-22044 
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@RequestMapping`-annotated interface methods.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Spring Cloud OpenFeign
Published: 2021-10-28T15:20:15.000Z
CVE-2021-22045 
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.
Problem types: description: Heap-based Buffer Overflow Vulnerability
Affected products: vendor: n/a
product: VMware ESXi, VMware Workstation and VMware Fusion
Published: 2022-01-04T21:39:03.000Z
CVE-2021-22047 
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Spring Data REST
Published: 2021-10-28T15:21:26.000Z
CVE-2021-22048 
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server and VMware Cloud Foundation
Published: 2021-11-10T17:50:53.000Z
CVE-2021-22049 
The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
Problem types: description: SSRF vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server and VMware Cloud Foundation
Published: 2021-11-24T16:32:59.000Z
CVE-2021-22050 
ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware ESXi and VMware Cloud Foundation
Published: 2022-02-16T16:37:56.000Z
CVE-2021-22051 
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Problem types: description: Specifically crafted requests could make an extra request on downstream services.
Affected products: vendor: n/a
product: Spring Cloud Gateway
Published: 2021-11-08T13:37:29.000Z
CVE-2021-22053 
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: n/a
product: Spring Cloud Netflix
Published: 2021-11-19T15:56:11.000Z