Known vulnerabilities in Aria Automation (formerly vRealize Automation) 7.6

Known vulnerabilities in Aria Automation (formerly vRealize Automation) 7.6

Vendor: Broadcom

Software: Aria Automation (formerly vRealize Automation)

Version: 7.6

Software CPE: cpe:2.3:a:broadcom:vrealize_automation:*:*:*:*:*:*:*:*

Website: https://www.broadcom.com/

Total vulnerabilities: 17

Public exploits: 4

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Vulnerabilities (17)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU65991 - Improper Control of Generation of Code ('Code Injection') CVE-2022-31665	CWE-94	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65990 - Permissions, Privileges, and Access Controls CVE-2022-31664	CWE-264	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65989 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-31663	CWE-79	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65988 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2022-31662	CWE-22	Medium	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080256 and 4 more
#VU65987 - Permissions, Privileges, and Access Controls CVE-2022-31661	CWE-264	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65986 - Permissions, Privileges, and Access Controls CVE-2022-31660	CWE-264	Low	Public exploit available	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65985 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2022-31659	CWE-89	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65984 - Improper Control of Generation of Code ('Code Injection') CVE-2022-31658	CWE-94	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65983 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2022-31657	CWE-601	Low	No	No	-	02.08.2022	SB2022080254 SB2022080255 SB2022080257 and 3 more
#VU65957 - Improper Authentication CVE-2022-31656	CWE-287	Critical	No	No	-	02.08.2022	SB2022080229 SB2022081126
#VU63406 - Improper Authentication CVE-2022-22972	CWE-287	High	Public exploit available	No	-	18.05.2022	SB2022051838
#VU61935 - Incorrect Default Permissions CVE-2022-22960	CWE-276	Low	Public exploit available	Exploited	-	06.04.2022	SB2022040612 SB2022040613 SB2022040614 and 4 more
#VU61934 - Cross-Site Request Forgery (CSRF) CVE-2022-22959	CWE-352	High	No	No	-	06.04.2022	SB2022040612 SB2022040613 SB2022040614 and 4 more
#VU61933 - Deserialization of Untrusted Data CVE-2022-22958	CWE-502	Low	No	No	-	06.04.2022	SB2022040612 SB2022040613 SB2022040614 and 4 more
#VU61932 - Deserialization of Untrusted Data CVE-2022-22957	CWE-502	Low	Public exploit available	No	-	06.04.2022	SB2022040612 SB2022040613 SB2022040614 and 4 more
#VU59054 - Server-Side Request Forgery (SSRF) CVE-2021-22056	CWE-918	Low	No	No	-	20.12.2021	SB2021122001 SB2021122002 SB2021122003
#VU55615 - Server-Side Request Forgery (SSRF) CVE-2021-22002	CWE-918	High	No	No	-	05.08.2021	SB2021080524 SB2021080525 SB2021080526 and 3 more