Esx (Vmware) - vulnerabilities (CVEs)

63 CVEs, 0 in the last 30 days, 39 known versions, newest CVE from 2026-07-30. Vendor: Vmware.

CVEs of Esx

CVE-2026-41709 - CVSS 2.7 (low), 2026-07-30: VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being…
CVE-2026-41703 - CVSS 7.6 (high), 2026-07-30: VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an…
CVE-2026-47876 - CVSS 9.3 (critical), 2026-07-30: VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a…
CVE-2014-7169 - CVSS 9.8 (critical), 2014-09-25: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows…
CVE-2014-6271 - CVSS 9.8 (critical), 2014-09-24: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute…
CVE-2014-1207 - CVSS 4.3 (medium), 2014-01-17: VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying…
CVE-2014-1208 - CVSS 3.3 (low), 2014-01-17: VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1…
CVE-2013-5973 - CVSS 4.4 (medium), 2013-12-23: VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource…
CVE-2013-3519 - CVSS 7.9 (high), 2013-12-04: lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware…
CVE-2013-5970 - CVSS 7.1 (high), 2013-10-21: hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service outage) by…
CVE-2013-3658 - CVSS 9.4 (critical), 2013-09-10: Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via…
CVE-2013-3657 - CVSS 7.5 (high), 2013-09-10: Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code or cause a denial of service via…
CVE-2013-1661 - CVSS 4.3 (medium), 2013-09-04: VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers…
CVE-2013-1405 - CVSS 10 (critical), 2013-02-15: VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before…
CVE-2013-1406 - CVSS 7.2 (high), 2013-02-11: The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware…
CVE-2012-5703 - CVSS 5 (medium), 2012-11-20: The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1)…
CVE-2012-1666 - CVSS 6.9 (medium), 2012-09-08: Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View…
CVE-2012-3289 - CVSS 7.8 (high), 2012-06-14: VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to…
CVE-2012-3288 - CVSS 9.3 (critical), 2012-06-14: VMware Workstation 7.x before 7.1.6 and 8.x before 8.0.4, VMware Player 3.x before 3.1.6 and 4.x before 4.0.4, VMware Fusion 4.x before 4.1.3, VMware ESXi 3.5…
CVE-2012-1517 - CVSS 9 (critical), 2012-05-04: The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory…
CVE-2012-2450 - CVSS 9 (critical), 2012-05-04: VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through…
CVE-2012-1516 - CVSS 9.9 (critical), 2012-05-04: The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of…
CVE-2012-2449 - CVSS 9 (critical), 2012-05-04: VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through…
CVE-2012-2448 - CVSS 7.5 (high), 2012-05-04: VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS…
CVE-2012-1518 - CVSS 8.3 (high), 2012-04-17: VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through…
CVE-2012-1515 - CVSS 8.3 (high), 2012-04-02: VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS…
CVE-2012-1510 - CVSS 7.2 (high), 2012-03-16: Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to…
CVE-2012-1508 - CVSS 7.2 (high), 2012-03-16: The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS…
CVE-2010-4655 - CVSS 5.5 (medium), 2011-07-18: net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive…
CVE-2011-2146 - CVSS 2.1 (low), 2011-06-06: mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x…
CVE-2011-2145 - CVSS 6.3 (medium), 2011-06-06: mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x…
CVE-2011-1787 - CVSS 6.9 (medium), 2011-06-06: Race condition in mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware…
CVE-2010-4251 - CVSS 7.5 (high), 2011-05-26: The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote…
CVE-2011-1789 - CVSS 5 (medium), 2011-05-09: The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before…
CVE-2011-1785 - CVSS 7.8 (high), 2011-05-03: VMware ESXi 4.0 and 4.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (socket exhaustion) via unspecified network traffic.
CVE-2011-1786 - CVSS 5 (medium), 2011-05-03: lsassd in Likewise Open /Enterprise 5.3 before build 7845, Open 6.0 before build 8325, and Enterprise 6.0 before build 178, as distributed in VMware ESXi 4.1…
CVE-2010-3609 - CVSS 5 (medium), 2011-03-11: The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in…
CVE-2011-0355 - CVSS 7.8 (high), 2011-02-17: Cisco Nexus 1000V Virtual Ethernet Module (VEM) 4.0(4) SV1(1) through SV1(3b), as used in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, does not properly…
CVE-2010-4263 - CVSS 7.9 (high), 2011-01-18: The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single…
CVE-2010-4526 - CVSS 7.1 (high), 2011-01-11: Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a…
CVE-2010-4343 - CVSS 5.5 (medium), 2010-12-29: drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of…
CVE-2010-4297 - CVSS 7.2 (high), 2010-12-06: The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before…
CVE-2010-2943 - CVSS 8.1 (high), 2010-09-30: The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote…
CVE-2010-3081 - CVSS 7.8 (high), 2010-09-24: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate…
CVE-2010-3078 - CVSS 5.5 (medium), 2010-09-21: The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which…
CVE-2010-2942 - CVSS 5.5 (medium), 2010-09-21: The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members…
CVE-2010-2066 - CVSS 5.5 (medium), 2010-09-08: The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a…
CVE-2010-2798 - CVSS 7.8 (high), 2010-09-08: The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel…
CVE-2010-2524 - CVSS 7.8 (high), 2010-09-08: The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's…
CVE-2010-2492 - CVSS 7.8 (high), 2010-09-08: Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users…
CVE-2010-1142 - CVSS 8.5 (high), 2010-04-12: VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459;…
CVE-2010-1141 - CVSS 8.5 (high), 2010-04-12: VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459;…
CVE-2009-3080 - CVSS 7.2 (high), 2009-11-20: Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service…
CVE-2009-3547 - CVSS 7 (high), 2009-11-04: Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and…
CVE-2009-2267 - CVSS 6.9 (medium), 2009-11-02: VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server…
CVE-2009-3733 - CVSS 5 (medium), 2009-11-02: Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX…
CVE-2009-3621 - CVSS 5.5 (medium), 2009-10-22: net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace…
CVE-2009-2848 - CVSS 5.9 (medium), 2009-08-18: The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local…
CVE-2009-2416 - CVSS 6.5 (medium), 2009-08-11: Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a…
CVE-2009-1805 - CVSS 4 (medium), 2009-06-01: Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware…
CVE-2009-1630 - CVSS 4.4 (medium), 2009-05-14: The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not…
CVE-2009-1244 - CVSS 6.8 (medium), 2009-04-13: Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1…
CVE-2009-1072 - CVSS 4.9 (medium), 2009-03-25: nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create…
CVE-2009-0778 - CVSS 7.1 (high), 2009-03-12: The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the…
CVE-2008-4914 - CVSS 4.7 (medium), 2009-02-03: Unspecified vulnerability in VMware ESXi 3.5 before ESXe350-200901401-I-SG and ESX 3.5 before ESX350-200901401-SG allows local administrators to cause a…
CVE-2009-0034 - CVSS 7.8 (high), 2009-01-30: parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a…
CVE-2008-4917 - CVSS 7.2 (high), 2008-12-09: Unspecified vulnerability in VMware Workstation 5.5.8 and earlier, and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier, and 2.0.5 and earlier…
CVE-2008-4281 - CVSS 9.3 (critical), 2008-11-10: Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the…
CVE-2008-4915 - CVSS 6.9 (medium), 2008-11-10: The CPU hardware emulation in VMware Workstation 6.0.5 and earlier and 5.5.8 and earlier; Player 2.0.x through 2.0.5 and 1.0.x through 1.0.8; ACE 2.0.x…
CVE-2008-4279 - CVSS 6.8 (medium), 2008-10-06: The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player…
CVE-2008-2101 - CVSS 2.1 (low), 2008-09-03: The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line, which allows…
CVE-2008-3281 - CVSS 6.5 (medium), 2008-08-27: libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause…
CVE-2008-0967 - CVSS 6.9 (medium), 2008-06-05: Untrusted search path vulnerability in vmware-authd in VMware Workstation 5.x before 5.5.7 build 91707 and 6.x before 6.0.4 build 93057, VMware Player 1.x…
CVE-2007-5671 - CVSS 4.4 (medium), 2008-06-05: HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build…
CVE-2008-2097 - CVSS 9 (critical), 2008-06-05: Buffer overflow in the openwsman management service in VMware ESXi 3.5 and ESX 3.5 allows remote authenticated users to gain privileges via an "invalid…
CVE-2008-2100 - CVSS 7.2 (high), 2008-06-05: Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware…
CVE-2007-5360 - CVSS 7.5 (high), 2008-01-08: Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWare ESX Server…
CVE-2007-0063 - CVSS 10 (critical), 2007-09-21: Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and…
CVE-2007-0061 - CVSS 10 (critical), 2007-09-21: The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1…
CVE-2007-1270 - CVSS 5 (medium), 2007-04-06: Double free vulnerability in VMware ESX Server 3.0.0 and 3.0.1 allows attackers to cause a denial of service (crash), obtain sensitive information, or…
CVE-2007-1271 - CVSS 6.6 (medium), 2007-04-06: Buffer overflow in VMware ESX Server 3.0.0 and 3.0.1 might allow attackers to gain privileges or cause a denial of service (application crash) via unspecified…
CVE-2006-2481 - CVSS 5 (medium), 2006-07-31: VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and…
CVE-2006-3589 - CVSS 3.6 (low), 2006-07-21: vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause…
CVE-2005-3620 - CVSS 2.1 (low), 2005-12-31: The management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2.1.3 patch 1, and 2.x before 2.5.3 patch 2 records passwords in…
CVE-2005-3619 - CVSS 6.8 (medium), 2005-12-31: Cross-site scripting (XSS) vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2, 2.1.x before 2.1.2 upgrade patch 6,…
CVE-2005-3618 - CVSS 7.6 (high), 2005-12-31: Cross-site request forgery (CSRF) vulnerability in the management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2.1.3 patch 1, and…
CVE-2005-4773 - CVSS 4.9 (medium), 2005-12-31: The configuration of VMware ESX Server 2.x, 2.0.x, 2.1.x, and 2.5.x allows local users to cause a denial of service (shutdown) via the (1) halt, (2) poweroff,…
CVE-2005-4583 - CVSS 4.3 (medium), 2005-12-29: Unspecified vulnerability in the Management Interface in VMware ESX Server 2.x up to 2.5.x before 24 December 2005 allows "remote code execution in the Web…
CVE-2003-1291 - CVSS 7.2 (high), 2003-12-31: VMware ESX Server 1.5.2 before Patch 4 allows local users to execute arbitrary programs as root via certain modified VMware ESX Server environment variables.