CVE-2016-7459

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

• CWE-611

• http://www.securityfocus.com/bid/94486Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037329
• http://www.vmware.com/security/advisories/VMSA-2016-0022.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/94486Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037329
• http://www.vmware.com/security/advisories/VMSA-2016-0022.htmlPatch, Vendor Advisory

Published

Dec 29, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7452The Pixidou Image Editor in Exponent CMS prior to v2.3.9 pat…
• CVE-2016-7453The Pixidou Image Editor in Exponent CMS prior to v2.3.9 pat…
• CVE-2016-7454CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisc…
• CVE-2016-7456VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has …
• CVE-2016-7457VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allo…
• CVE-2016-7458VMware vSphere Client 5.5 before U3e and 6.0 before U2a allo…
• CVE-2016-7460The Single Sign-On feature in VMware vCenter Server 5.5 befo…
• CVE-2016-7461The drag-and-drop (aka DnD) function in VMware Workstation P…
• CVE-2016-7462The Suite REST API in VMware vRealize Operations (aka vROps)…
• CVE-2016-7463Cross-site scripting (XSS) vulnerability in the Host Client …
• CVE-2016-7464Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7465Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…