VMware：悪用された脆弱性
- 26件の悪用された脆弱性
- 9ランサムウェアで使用
- 2025/03/04最新の追加
- vCenter Server 9
- ESXi 3
- Multiple Products 3
- ESXi, Workstation, and Fusion 1
- ESXi and Workstation 1
- Tools 1
- Aria Operations for Networks 1
- Spring Cloud Gateway 1
- Workspace ONE Access and Identity Manager 1
- Spring Framework 1
- SD-WAN Edge 1
- vCenter Server and Cloud Foundation 1
- vRealize Operations Manager API 1
- VMware ESXi and Horizon DaaS 1
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2025/03/04 | Information Disclosure | ESXi, Workstation, and Fusion | 高 7.1 | 1.6% |
| 2025/03/04 | Arbitrary Write | ESXi | 高 8.2 | 1.0% |
| 2025/03/04 | TOCTOU Race Condition | ESXi and Workstation | 緊急 9.3 | 1.6% |
| 2024/11/20 | Privilege Escalation | vCenter Server | 高 7.5 | 17% |
| 2024/11/20 | Heap-Based Buffer Overflow | vCenter Server | 緊急 9.8 | 55% |
| 2024/07/30 | Authentication Bypass | ESXi | 中 6.8 | 27% |
| 2024/07/17 | Incorrect Default File Permissions Vulnerability | vCenter Server | 中 6.5 | 13% |
| 2024/01/22 | Out-of-Bounds Write | vCenter Server | 緊急 9.8 | 99.2% |
| 2023/06/23 | Authentication Bypass | Tools | 低 3.9 | 14% |
| 2023/06/22 | Command Injection | Aria Operations for Networks | 緊急 9.8 | 98% |
| 2022/05/16 | Code Injection | Spring Cloud Gateway | 緊急 10.0 | 98% |
| 2022/04/15 | Privilege Escalation | Multiple Products | 高 7.8 | 36% |
| 2022/04/14 | Server-Side Template Injection | Workspace ONE Access and Identity Manager | 緊急 9.8 | >99.9% |
| 2022/04/04 | JDK 9+ Remote Code Execution | Spring Framework | 緊急 9.8 | 99.6% |
| 2022/03/25 | by VeloCloud Command Injection | SD-WAN Edge | 高 8.1 | 85% |
| 2022/03/07 | Server Side Request Forgery (SSRF) | vCenter Server and Cloud Foundation | 中 5.3 | 88% |
| 2022/01/18 | Server Side Request Forgery in vRealize Operations Manager API | vRealize Operations Manager API | 緊急 9.8 | 78% |
| 2022/01/10 | Improper Access Control | vCenter Server | 中 5.3 | 49% |
| 2021/11/03 | File Upload | vCenter Server | 緊急 9.8 | >99.9% |
| 2021/11/03 | Improper Input Validation | vCenter Server | 緊急 9.8 | >99.9% |
| 2021/11/03 | Remote Code Execution | vCenter Server | 緊急 9.8 | 99.9% |
| 2021/11/03 | Multiple VMware Products Command Injection | Multiple Products | 緊急 9.1 | 17% |
| 2021/11/03 | OpenSLP Use-After-Free | ESXi | 緊急 9.8 | 83% |
| 2021/11/03 | Information Disclosure | vCenter Server | 緊急 9.8 | 90% |
| 2021/11/03 | Privilege Escalation | Multiple Products | 高 7.8 | 7.3% |
| 2021/11/03 | ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow | VMware ESXi and Horizon DaaS | 緊急 9.8 | 98% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。