Ca Technologies vulnerabilities
33 vulnerabilities
Known vulnerabilities in Ca Technologies products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.
Products
12- CA Privileged Access Manager10 vulnerabilities
- PPM5 vulnerabilities
- CA API Developer Portal4 vulnerabilities
- Unified Infrastructure Management4 vulnerabilities
- CA Identity Governance2 vulnerabilities
- CA Service Desk Manager2 vulnerabilities
- Workload Automation AE2 vulnerabilities
- CA Spectrum1 vulnerabilities
- Client Automation1 vulnerabilities
- Identity Manager1 vulnerabilities
- Release Automation1 vulnerabilities
- Workload Control Center1 vulnerabilities
CVE-2018-13819ca_technologiesunified_infrastructure_management+1
EPSS score1.38%
A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.CVE-2018-13822broadcomproject_portfolio_management+1EPSS score1.33%
Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information.CVE-2018-13824broadcomproject_portfolio_management+2EPSS score1.75%
Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.CVE-2018-13826broadcomproject_portfolio_management+2EPSS score1.83%
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.CVE-2018-13823broadcomproject_portfolio_management+2EPSS score1.88%
An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.CVE-2018-13821ca_technologiesunified_infrastructure_management+1EPSS score2.68%
A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.CVE-2018-13820ca_technologiesunified_infrastructure_management+1EPSS score1.38%
A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.CVE-2018-13825broadcomproject_portfolio_management+2EPSS score0.90%
Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.CVE-2018-19634broadcomservice_desk_manager+2EPSS score1.33%
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.CVE-2018-19635broadcomservice_desk_manager+2EPSS score1.18%
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.CVE-2018-9027ca technologiesca privileged access manager+1EPSS score0.90%
A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with a specially crafted link.CVE-2018-9025broadcomprivileged_access_manager+1EPSS score1.39%
An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input.CVE-2018-9029broadcomprivileged_access_manager+1EPSS score1.73%
An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.CVE-2018-9021broadcomprivileged_access_manager+1EPSS score9.61%
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.CVE-2018-9022broadcomprivileged_access_manager+1EPSS score12.80%
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.CVE-2018-9026broadcomprivileged_access_manager+1EPSS score1.32%
A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.CVE-2018-9028broadcomprivileged_access_manager+1EPSS score0.90%
Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.CVE-2018-9024broadcomprivileged_access_manager+1EPSS score1.13%
An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file.CVE-2018-9023broadcomprivileged_access_manager+1EPSS score1.88%
An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the update_crld script.CVE-2018-14597broadcomca_identity_governance+2EPSS score1.34%
CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.