Known vulnerabilities in VMware Identity Manager 3.3.3

Vendor: Broadcom
Software: VMware Identity Manager
Version: 3.3.3
Software CPE: cpe:2.3:a:broadcom:identity_manager:*:*:*:*:*:*:*:*
Website: https://www.broadcom.com/
Total vulnerabilities: 13
Public exploits: 5
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting VMware Identity Manager version 3.3.3 VMware Identity Manager 3.3.3 is affected by 13 vulnerabilities: 2 critical, 3 high, 2 medium, 6 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU63407 - Permissions, Privileges, and Access Controls
CVE-2022-22973		 CWE-264 Low
No
No
 - 18.05.2022 SB2022051838
#VU63406 - Improper Authentication
CVE-2022-22972		 CWE-287 High
Public exploit available
No
 - 18.05.2022 SB2022051838
#VU61936 - Exposure of sensitive information to an unauthorized actor
CVE-2022-22961		 CWE-200 Medium
No
No
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040615
and 1 more
#VU61935 - Incorrect Default Permissions
CVE-2022-22960		 CWE-276 Low
Public exploit available
Exploited
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040614
and 4 more
#VU61934 - Cross-Site Request Forgery (CSRF)
CVE-2022-22959		 CWE-352 High
No
No
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040614
and 4 more
#VU61933 - Deserialization of Untrusted Data
CVE-2022-22958		 CWE-502 Low
No
No
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040614
and 4 more
#VU61932 - Deserialization of Untrusted Data
CVE-2022-22957		 CWE-502 Low
Public exploit available
No
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040614
and 4 more
#VU61929 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-22954		 CWE-94 Critical
Public exploit available
Exploited
 - 06.04.2022 SB2022040612
SB2022040613
SB2022040615
and 1 more
#VU59054 - Server-Side Request Forgery (SSRF)
CVE-2021-22056		 CWE-918 Low
No
No
 - 20.12.2021 SB2021122001
SB2021122002
SB2021122003
#VU58816 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44228		 CWE-94 Critical
Public exploit available
Exploited
 - 10.12.2021 SB2021121003
SB2021121101
SB2021121201
and 338 more
#VU55616 - Unprotected primary channel
CVE-2021-22003		 CWE-419 Low
No
No
 - 05.08.2021 SB2021080524
SB2021080525
SB2021080526
and 2 more
#VU55615 - Server-Side Request Forgery (SSRF)
CVE-2021-22002		 CWE-918 High
No
No
 - 05.08.2021 SB2021080524
SB2021080525
SB2021080526
and 3 more
#VU48624 - Command injection
CVE-2020-4006		 CWE-77 Medium
No
Exploited
 - 23.11.2020 SB2020112415