CVE-2021-21978

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.

• CWE-20
• CWE-862

• http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.vmware.com/security/advisories/VMSA-2021-0003.htmlVendor Advisory
• http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.vmware.com/security/advisories/VMSA-2021-0003.htmlVendor Advisory

Published

Mar 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21971An out-of-bounds write vulnerability exists in the URL_decod…5.9
• CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution …9.8
• CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Req…5.3
• CVE-2021-21974OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 …8.8
• CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager A…7.5
• CVE-2021-21976vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8…7.2
• CVE-2021-21979In Bitnami Containers, all Laravel container versions prior …7.3
• CVE-2021-2198Vulnerability in the Oracle Knowledge Management product of …8.2
• CVE-2021-21980The vSphere Web Client (FLEX/Flash) contains an unauthorized…7.5
• CVE-2021-21981VMware NSX-T contains a privilege escalation vulnerability d…7.8
• CVE-2021-21982VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 …9.1
• CVE-2021-21983Arbitrary file write vulnerability in vRealize Operations Ma…6.5