Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

20 records

Vendor: VMware Component: Vrealize Automation Clear all filters
TI-2022-07133 CVE-2022-22956 · GHSA-54hw-pp59-j3rc

Improper authentication in VMware Workspace ONE Access

Priority HIGH 73

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49533 Published 2022-04-13 No fix listed CWE-287
TI-2022-07131 CVE-2022-22954 · GHSA-q7xc-35g4-g566

Code injection in VMware Workspace ONE Access and Identity Manager

Priority CRITICAL 100KEV

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2022-04-11 No fix listed CWE-94
TI-2021-05078 CVE-2021-22036 · GHSA-xhgj-fcgm-66qp

Information disclosure in VMware vRealize Orchestrator

Priority LOW 31

VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00925 Published 2021-10-13 No fix listed CWE-200
TI-2018-05081 CVE-2018-6959 · GHSA-rg5g-5cq4-g4m7

Session fixation in VMware vRealize Automation

Priority MEDIUM 46

VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01993 Published 2018-04-13 Fixed in 7.4.0 CWE-384
TI-2018-05080 CVE-2018-6958 · GHSA-hvxm-j3vp-wx4q

Cross-site scripting in VMware vRealize Automation

Priority LOW 29

VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2018-04-13 Fixed in 7.3.1 CWE-79
TI-2017-03078 CVE-2017-4947 · GHSA-7h28-vxhx-xhw6

Deserialization of untrusted data in VMware vRealize Automation

Priority MEDIUM 53

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08588 Published 2018-01-29 Fixed in 1.3 CWE-502
TI-2016-06355 CVE-2016-7460 · GHSA-mhmr-f673-jqv8

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and…

Priority MEDIUM 43

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML docum…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.02146 Published 2016-12-29 No fix listed CWE-611