This page lists publicly disclosed CVE vulnerabilities affecting vmware cloud_foundation (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2024-38834 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | [email protected] | 6.5 | 0.31% | 2024-11-26 | 2026-06-17 |
| CVE-2024-38833 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | [email protected] | 6.8 | 0.40% | 2024-11-26 | 2026-06-17 |
| CVE-2024-38832 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | [email protected] | 7.1 | 0.44% | 2024-11-26 | 2026-06-17 |
| CVE-2024-38831 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria Operations. | [email protected] | 7.8 | 0.29% | 2024-11-26 | 2026-06-17 |
| CVE-2024-38830 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations. | [email protected] | 7.8 | 0.18% | 2024-11-26 | 2026-06-17 |
| CVE-2024-38813 KEV | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet. | [email protected] | 7.5 | 16.68% | 2024-09-17 | 2026-06-17 |
| CVE-2024-38812 KEV | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. | [email protected] | 9.8 | 54.14% | 2024-09-17 | 2026-06-17 |
| CVE-2024-22280 | VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database. | [email protected] | 8.5 | 0.47% | 2024-07-11 | 2026-06-17 |
| CVE-2024-37087 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. | [email protected] | 5.3 | 0.71% | 2024-06-25 | 2026-06-17 |
| CVE-2024-37086 | VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host. | [email protected] | 6.8 | 0.19% | 2024-06-25 | 2026-06-17 |
| CVE-2024-37085 KEV | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. | [email protected] | 6.8 | 26.77% | 2024-06-25 | 2026-06-17 |
| CVE-2024-37081 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. | [email protected] | 7.8 | 4.99% | 2024-06-18 | 2026-06-17 |
| CVE-2024-37079 KEV | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. | [email protected] | 9.8 | 22.38% | 2024-06-18 | 2026-06-17 |
| CVE-2024-22275 | The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data. | [email protected] | 4.9 | 0.99% | 2024-05-21 | 2026-06-17 |
| CVE-2024-22274 | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system. | [email protected] | 7.2 | 2.49% | 2024-05-21 | 2026-06-17 |
| CVE-2024-22273 | The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues. | [email protected] | 8.1 | 0.16% | 2024-05-21 | 2026-06-17 |
| CVE-2024-22255 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process. | [email protected] | 7.1 | 2.31% | 2024-03-05 | 2026-06-17 |
| CVE-2024-22254 | VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox. | [email protected] | 7.9 | 0.50% | 2024-03-05 | 2026-06-17 |
| CVE-2024-22253 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. | [email protected] | 9.3 | 0.65% | 2024-03-05 | 2026-06-17 |
| CVE-2024-22235 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. | [email protected] | 6.7 | 0.19% | 2024-02-21 | 2026-06-17 |