Deserialization of untrusted data

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-5334

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-7462

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

CVE-2016-5334

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-7457

CVE-2016-7457 affects VMware vRealize Operations (vROps) 6.x prior to 6.4.0. A privilege-escalation vulnerability could allow a remote authenticated vROps user (low-privileged) to gain full access to the application and potentially stop or delete virtual machines. The primary root cause is a priv...

CVE-2016-7462

CVE-2016-7462 affects VMware vRealize Operations (vROps) 6.x prior to 6.4.0. The REST API deserialization vulnerability allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload mishandled during deserialization. VM...

CVE-2016-5334

CVE-2016-5334 affects VMware Identity Manager 2.x < 2.7.1 and vRealize Automation 7.x

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7460

CVE-2016-7460 refers to an XML External Entity (XXE) vulnerability in the Single Sign-On feature of VMware products. Affects vCenter Server 5.5 before U3e and 6.0 before U2a, and vRealize Automation 6.x before 6.2.5. A specially crafted XML document containing an external entity declaration and a...

PT-2016-6370

Name of the Vulnerable Software and Affected Versions VMware Identity Manager versions prior to 2.7.1 vRealize Automation versions prior to 7.2.0 Description The issue allows remote attackers to read sensitive files, specifically /SAAS/WEB-INF and /SAAS/META-INF files, via unspecified vectors...

PT-2016-7342

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations versions prior to 6.4.0 Description The issue allows remote authenticated users to gain privileges or halt and remove virtual machines via unspecified vectors. Recommendations For versions prior to 6.4.0, update to...

PT-2016-7344

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations versions prior to 6.4.0 Description The issue allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during...

CVE-2016-7460: Improper Restriction of XML External Entity Reference

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-5334: Exposure of Resource to Wrong Sphere

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-7462: Exposed Dangerous Method or Function

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

CVE-2016-7457: Undefined Security Weakness

VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors...

VMware Identity Manager and vRealize Automation Information Disclosure Vulnerability

VMware Identity Manager and vRealize Automation are both VMware products. vMware Identity Manager is an Identity-as-a-Service IDaaS product that provides application provisioning, self-service catalogs, and Single Sign-On SSO for SaaS, Web, Cloud, and native mobile applications. vMware vRealize...

XML External Entity Injection Vulnerability in Multiple VMware Products

VMware vCenter Server is a suite of server and virtualization management software from VMware, Inc. VMware vRealize Automation is a suite of cloud automation software from VMware, Inc. An XML external entity injection vulnerability exists in multiple VMware products and can be exploited by an...

VMware vRealize Automation XML External Entity (XXE) Vulnerability (VMSA-2016-0022)

VMware vRealize Automation contain an XML External Entity XXE vulnerability in the Single Sign-On functionality. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...