CA vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-28250 CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file.High 7.8 · Mar 26, 2021
• CVE-2021-28249 CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library.High 8.8 · Mar 26, 2021
• CVE-2019-13656 An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to Critical 9.8 · Sep 6, 2019
• CVE-2018-19635 CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.Critical 9.8 · Jan 22, 2019
• CVE-2018-19634 CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.High 7.5 · Jan 22, 2019
• CVE-2018-15691 Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary cCritical 9.8 · Aug 30, 2018
• CVE-2018-13826 An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote aCritical 9.1 · Aug 30, 2018
• CVE-2018-13824 Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to eCritical 9.8 · Aug 30, 2018
• CVE-2018-13823 An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote aHigh 7.5 · Aug 30, 2018
• CVE-2018-13822 Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive informHigh 7.5 · Aug 30, 2018
• CVE-2018-13821 A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including fileCritical 9.8 · Aug 30, 2018
• CVE-2018-13820 A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.High 7.5 · Aug 30, 2018
• CVE-2018-13819 A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.High 7.5 · Aug 30, 2018
• CVE-2018-9029 An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.Critical 9.8 · Jun 18, 2018
• CVE-2018-9028 Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.High 7.5 · Jun 18, 2018
• CVE-2018-9026 A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.High 7.5 · Jun 18, 2018
• CVE-2018-9025 An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input.High 7.5 · Jun 18, 2018
• CVE-2018-9023 An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted argumHigh 8.8 · Jun 18, 2018
• CVE-2018-9022 An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisonCritical 9.8 · Jun 18, 2018
• CVE-2018-9021 An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crCritical 9.8 · Jun 18, 2018
• CVE-2015-4664 An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.Critical 9.8 · Jun 18, 2018
• CVE-2018-6589 CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors.High 7.5 · May 1, 2018
• CVE-2018-8954 CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.Critical 9.8 · Apr 11, 2018
• CVE-2018-8953 CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.High 8.8 · Apr 11, 2018
• CVE-2017-9393 CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive searchCritical 9.8 · Sep 22, 2017