Ca

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-28250 1Ca 1Ehealth Performance Manager Nov 21, 2024 Mar 26, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be execu...Show more CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2021-28249 1Ca 1Ehealth Performance Manager Nov 21, 2024 Mar 26, 2021 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the wr...Show more CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2021-28247 1Ca 1Ehealth Performance Manager Nov 21, 2024 Mar 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-...Show more CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2019-7394 1Ca 2Risk Authentication Strong Authentication Nov 21, 2024 May 28, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows...Show more A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.Show less
CVE-2019-7393 1Ca 2Risk Authentication Strong Authentication Nov 21, 2024 May 28, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remot...Show more A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.Show less
CVE-2018-19635 2Broadcom Ca 2Service Desk Manager Service Desk Manager Nov 21, 2024 Jan 22, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.
CVE-2018-19634 2Broadcom Ca 2Service Desk Manager Service Desk Manager Nov 21, 2024 Jan 22, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.
CVE-2018-13826 2Broadcom Ca 2Project Portfolio Management Project Portfolio Management Nov 21, 2024 Aug 30, 2018 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.
CVE-2018-13825 2Broadcom Ca 2Project Portfolio Management Project Portfolio Management Nov 21, 2024 Aug 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting atta...Show more Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.Show less
CVE-2018-13824 2Broadcom Ca 2Project Portfolio Management Project Portfolio Management Nov 21, 2024 Aug 30, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.
CVE-2018-13823 2Broadcom Ca 2Project Portfolio Management Project Portfolio Management Nov 21, 2024 Aug 30, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.
CVE-2018-13821 1Ca 1Unified Infrastructure Management Nov 21, 2024 Aug 30, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.
CVE-2018-13820 1Ca 1Unified Infrastructure Management Nov 21, 2024 Aug 30, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.
CVE-2018-13819 1Ca 1Unified Infrastructure Management Nov 21, 2024 Aug 30, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.
CVE-2018-9027 1Ca 1Ca Privileged Access Manager Nov 21, 2024 Jun 18, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with a specially crafted link.
CVE-2018-6589 1Ca 1Spectrum Nov 21, 2024 May 1, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors.
CVE-2018-8954 1Ca 1Workload Control Center Nov 21, 2024 Apr 11, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.
CVE-2018-8953 1Ca 1Workload Automation Ae Nov 21, 2024 Apr 11, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.
CVE-2018-6588 1Ca 1Api Developer Portal Nov 21, 2024 Mar 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.
CVE-2018-6587 1Ca 1Api Developer Portal Nov 21, 2024 Mar 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.

12 3 4 5 6 7 Next