ZeusQA
Start free

Known exploited vulnerabilities

VMware Tanzu vulnerabilities attackers have used

Every VMware Tanzu vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 3 VMware Tanzu vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2022-22963, added Aug 25, 2022. Spring Cloud has the most entries (1).

In KEV, all time
3
Added, last 12 months
0
Used in ransomware
1
New CVEs this week
0

By product

Spring Cloud (1), Spring Cloud Configuration (Config) Server (1), Spring Data Commons (1).

Every VMware Tanzu entry in CISA KEV

  1. CVE-2022-22963

    Added · due

    VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

    When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

  2. CVE-2020-5410

    Added · due

    VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

    Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.

  3. CVE-2018-1273

    RansomwareAdded · due

    VMware Tanzu Spring Data Commons Property Binder Vulnerability

    Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works