Misconfiguration and Insecure Design

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attacker…CVE-2011-4404Vmware · 59% likely

   CWE-16

2. The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts…CVE-2020-4001Vmware · 2.9% likely

   CWE-1188

3. The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through ano…CVE-2008-1392Vmware · 2.7% likely

   CWE-16

4. VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)CVE-2025-41245VMware · CVSS 4.9 · 0.6% likely

   CWE-1188

5. [pgpool] Unauthenticated access to postgres through pgpoolCVE-2025-22248VMware · CVSS 9.4 · 0.5% likely

   CWE-1188

6. vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resour…CVE-2011-1681Vmware · 0.4% likely

   CWE-16

7. SSL bundle configuration silently bypassed in Spring Cloud GatewayCVE-2026-22750VMware · CVSS 7.5 · 0.2% likely

   CWE-15

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.