CVE-2016-7462

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename files via a crafted DiskFileItem in a relay-request payload that is mishandled during deserialization.

Metrics

CVSS 3.0 8.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Weakness enumeration

CWE-264 CWE-749

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/94351
http://www.securitytracker.com/id/1037297
http://www.vmware.com/security/advisories/VMSA-2016-0020.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2016-34Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/94351
http://www.securitytracker.com/id/1037297
http://www.vmware.com/security/advisories/VMSA-2016-0020.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2016-34Technical Description, Third Party Advisory

Timeline

Published: Dec 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74635.4Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated CVE-2016-74666.0Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS CVE-2016-74675.3The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider w CVE-2016-74685.9An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network tra CVE-2016-74695.4A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, A CVE-2016-74727.5F5 BIG-IP ASM version 12.1.0 - 12.1.1 may allow remote attackers to cause a denial of service (DoS) via a crafted HTTP request.CVE-2016-74745.5In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to CVE-2016-74757.5Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not prop CVE-2016-74767.5The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.CVE-2016-74775.5The ff_put_pixels8_xy2_mmx function in rnd_template.c in Libav 11.7 allows remote attackers to cause a denial of service (invalid memory acc CVE-2016-74787.5Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infin CVE-2016-74799.8In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-af