6.2.4

DATE	CVE	VULNERABILITY TITLE	RISK
2018-04-13	CVE-2018-6959	Session Fixation vulnerability in VMWare Vrealize Automation VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs. network low complexity vmware CWE-384	7.5
2018-04-13	CVE-2018-6958	Cross-site Scripting vulnerability in VMWare Vrealize Automation VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. network vmware CWE-79	4.3
2016-12-29	CVE-2016-7460	XXE vulnerability in VMWare Vrealize Automation The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. network low complexity vmware CWE-611	6.4