The version of VMware vRealize Operations (vROps) Manager running on the remote web server is 6.x prior to 6.40. It is, therefore, affected by a flaw in the Suite API CollectorHttpRelayController component due to improper validation of DiskFileItem objects stored in the 'relay-request' XML before attempting deserialization. An authenticated, remote attacker can exploit this issue, via a specially crafted DiskFileItem object embedded in the XML, to move or write arbitrary content to files, resulting in a denial of service condition.
VMSA-2016-0020: vRealize Operations REST API Deserialization Vulnerability
vRealize Operations update addresses REST API deserialization vulnerability