Vendor scorecard
VMware
VMware security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.
CPE: vmware, avinetworks
Product families
3
Open in latest
20
Inferred — see methodology
Last disclosure
Nov 24, 2020
01
Product categories
3 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| SD-WAN (VeloCloud)SD-WAN & SASEsd-wan, sd-wan_edge, sd-wan_orchestrator | 6 | 6 | 13.2.1MED | ||
| NSXNGFW / Network Security · Network Management & Monitoringnsx, nsx-t_data_center, nsx_data_center_for_vsphere | 1 | 0 | unknown | ||
| Avi Load BalancerApplication Delivery / ADCavi_vantage, nsx_advanced_load_balancer | 1 | 0 | 17.2.13LOW |
Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the VMware total above.
02
Disclosure trend
12 monthsCumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.
- Critical
- High
- Medium
- Low
03
Recent CVEs
8 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2020-4003(opens NVD record) | Medium | 6.5 | VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attacks allowing for potential information disclosure. An authenticated SD-WAN Orchestrator user may inject code into SQL queries which may lead to information disclosure. | Nov 24, 2020 |
| CVE-2020-4002(opens NVD record) | High | 7.2 | The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way. An authenticated SD-WAN Orchestrator user with high privileges may be able to execute arbitrary code on the underlying operating system. | Nov 24, 2020 |
| CVE-2020-4001(opens NVD record) | Critical | 9.8 | The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack. | Nov 24, 2020 |
| CVE-2020-4000(opens NVD record) | High | 8.8 | The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orchestrator user is able to traversal directories which may lead to code execution of files. | Nov 24, 2020 |
| CVE-2020-3985(opens NVD record) | High | 8.8 | The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges. | Nov 24, 2020 |
| CVE-2020-3984(opens NVD record) | Medium | 6.5 | The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injection. An authenticated SD-WAN Orchestrator user may exploit a vulnerable API call using specially crafted SQL queries which may lead to unauthorized data access. | Nov 24, 2020 |
| CVE-2018-19106(opens NVD record) | Medium | 6.1 | Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959. | Feb 20, 2019 |
| CVE-2014-3796(opens NVD record) | Medium | 5.0 | VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security (vCNS) 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive information via unspecified vectors. | Sep 15, 2014 |
8 CVEs · 3 product families