Design/Logic Flaw

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

Deserialization of untrusted data

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

CVE-2016-7457

VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors...

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7457

VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors...

CVE-2016-5334

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7462

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

CVE-2016-5334

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-5334

CVE-2016-5334 affects VMware Identity Manager 2.x < 2.7.1 and vRealize Automation 7.x

CVE-2016-7460

CVE-2016-7460 refers to an XML External Entity (XXE) vulnerability in the Single Sign-On feature of VMware products. Affects vCenter Server 5.5 before U3e and 6.0 before U2a, and vRealize Automation 6.x before 6.2.5. A specially crafted XML document containing an external entity declaration and a...

CVE-2016-7462

CVE-2016-7462 affects VMware vRealize Operations (vROps) 6.x prior to 6.4.0. The REST API deserialization vulnerability allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload mishandled during deserialization. VM...

CVE-2016-7457

CVE-2016-7457 affects VMware vRealize Operations (vROps) 6.x prior to 6.4.0. A privilege-escalation vulnerability could allow a remote authenticated vROps user (low-privileged) to gain full access to the application and potentially stop or delete virtual machines. The primary root cause is a priv...

CVE-2016-7460

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

CVE-2016-7457: Undefined Security Weakness

VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors...

PT-2016-6370

Name of the Vulnerable Software and Affected Versions VMware Identity Manager versions prior to 2.7.1 vRealize Automation versions prior to 7.2.0 Description The issue allows remote attackers to read sensitive files, specifically /SAAS/WEB-INF and /SAAS/META-INF files, via unspecified vectors...

CVE-2016-5334: Exposure of Resource to Wrong Sphere

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors...

CVE-2016-7462: Exposed Dangerous Method or Function

The Suite REST API in VMware vRealize Operations aka vROps 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization...

PT-2016-7342

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations versions prior to 6.4.0 Description The issue allows remote authenticated users to gain privileges or halt and remove virtual machines via unspecified vectors. Recommendations For versions prior to 6.4.0, update to...

PT-2016-7344

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations versions prior to 6.4.0 Description The issue allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during...