Server-Side Request Forgery

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. VMware vSphere - Server-Side Request ForgeryCVE-2021-21973VMware · CVSS 5.3 · 88% likely

   CWE-918

2. vRealize Operations Manager API - Server-Side Request ForgeryCVE-2021-21975VMware · CVSS 9.8 · 78% likely

   CWE-918

3. The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to…CVE-2021-22049Vmware · 1.7% likely

   CWE-918

4. VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be ab…CVE-2021-22056Vmware · 1.6% likely

   CWE-918

5. The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vReali…CVE-2021-22027Vmware · 1.2% likely

   CWE-918

6. The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vReali…CVE-2021-22026Vmware · 1.1% likely

   CWE-918

7. The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by access…CVE-2022-22982Vmware · 1.0% likely

   CWE-918

8. The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with acces…CVE-2021-21993Vmware · 0.9% likely

   CWE-918

9. Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.CVE-2021-22033Vmware · 0.6% likely

   CWE-918

10. VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)CVE-2025-22215VMware · CVSS 4.3 · 0.3% likely

    CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.