CVE-2021-21983Medium· 6.5▾ TwilightPoC availableArbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locati…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 13.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
69%
1 GitHub repo · Metasploit ×1
69% → 69%
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
cloud_foundation = 3.0cloud_foundation = 3.0.1cloud_foundation = 3.0.1.1cloud_foundation = 3.5cloud_foundation = 3.5.1cloud_foundation = 3.7cloud_foundation = 3.7.1cloud_foundation = 3.7.2cloud_foundation = 3.8cloud_foundation = 3.8.1cloud_foundation = 3.9cloud_foundation = 3.9.1cloud_foundation = 3.10cloud_foundation = 4.0cloud_foundation = 4.0.1vrealize_operations_manager = 7.0.0vrealize_operations_manager = 7.5.0vrealize_operations_manager = 8.0.0vrealize_operations_manager = 8.0.1vrealize_operations_manager = 8.1.0vrealize_operations_manager = 8.1.1vrealize_operations_manager = 8.2.0vrealize_operations_manager = 8.3.0vrealize_suite_lifecycle_manager = 8.0vrealize_suite_lifecycle_manager = 8.0.1vrealize_suite_lifecycle_manager = 8.1vrealize_suite_lifecycle_manager = 8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-21975High· 7.5Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal…
CVE-2021-21972Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin
CVE-2020-3992Critical· 9.8OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue
CVE-2025-22225High· 8.2VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
CVE-2022-22971Medium· 6.5In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2020-5398High· 7.5In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…