Vrealize Automation (Vmware) - vulnerabilities (CVEs)
20 CVEs, 0 in the last 30 days, 35 known versions, newest CVE from 2023-02-22. Vendor: Vmware.
CVEs of Vrealize Automation
- CVE-2023-20855 - CVSS 8.8 (high), 2023-02-22: VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator,…
- CVE-2022-22972 - CVSS 9.8 (critical), 2022-05-20: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious…
- CVE-2022-22958 - CVSS 7.2 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A…
- CVE-2022-22961 - CVSS 5.3 (medium), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A…
- CVE-2022-22957 - CVSS 7.2 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A…
- CVE-2022-22960 - CVSS 7.8 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support…
- CVE-2022-22959 - CVSS 4.3 (medium), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user…
- CVE-2022-22955 - CVSS 9.8 (critical), 2022-04-13: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may…
- CVE-2022-22956 - CVSS 9.8 (critical), 2022-04-13: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may…
- CVE-2022-22954 - CVSS 9.8 (critical), 2022-04-11: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with…
- CVE-2021-22056 - CVSS 7.5 (high), 2021-12-20: VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with…
- CVE-2021-22036 - CVSS 6.5 (medium), 2021-10-13: VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to…
- CVE-2018-6959 - CVSS 9.8 (critical), 2018-04-13: VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking…
- CVE-2018-6958 - CVSS 6.1 (medium), 2018-04-13: VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. Exploitation of…
- CVE-2017-4947 - CVSS 9.8 (critical), 2018-01-29: VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful…
- CVE-2016-7460 - CVSS 9.1 (critical), 2016-12-29: The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read…
- CVE-2016-5334 - CVSS 5.3 (medium), 2016-12-29: VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via…
- CVE-2016-5336 - CVSS 9.8 (critical), 2016-08-31: VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2016-5335 - CVSS 7.8 (high), 2016-08-31: VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.
- CVE-2015-2344 - CVSS 5.4 (medium), 2016-03-16: Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web…
