CVE-2019-3779 Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD

Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA Certificate Authority to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the...

Hyperledger: Enrolling to a CA that returns an empty response crashes the node process

If a CA server responds with an empty response during enrollment, an exception is thrown in the event emitter on end. This is an uncaughtException and causes the containing node process to exit. To replicate: With the attached files, run: npm install node badCa.js & node index.js This starts a...

CVE-2019-7392

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration...

CVE-2019-7392

The CVE-2019-7392 entry concerns an improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI (jk-manager, jk-status). Affected component: Web-UI authentication mechanism; root cause: improper/authentication weakness allowing remote access. Impact statements in sources indi...

CVE-2019-7392

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration...

PT-2019-18576

Name of the Vulnerable Software and Affected Versions CA Privileged Access Manager versions 3.x Description The issue is related to an improper authentication mechanism in the Web-UI jk-manager and jk-status components, allowing a remote attacker to obtain sensitive information or modify the...

CVE-2019-7392: Improper Authentication

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration...

Oracle MAF store bypass, a how-to

On a recent assignment I was asked to look at the security of a cloud-based solution for expenses, the Oracle® ExpensesCloud with Fusion applications. It was being used for employees to create/save/edit/submit claims to the employer. TL;DR Having default hardcoded credentials allows an attacker...

PT-2019-18124

Name of the Vulnerable Software and Affected Versions CA Automic Workload Automation versions 12.0 through 12.2 Description The issue is related to insufficient output sanitization in the Automic Web Interface AWI, which could allow attackers to conduct persistent cross-site scripting XSS attacks...

CVE-2019-6504

The CVE-2019-6504 refers to a Cross-Site Scripting (XSS) vulnerability in the Automic Web Interface (AWI) of CA Automic Workload Automation (formerly UC4), due to insufficient output sanitization. Affected are CA Automic Workload Automation versions 12.0 through 12.2, with the issue enabling pers...

CVE-2019-6504: Improper Neutralization of Input During Web Page Generation

Insufficient output sanitization in the Automic Web Interface AWI, in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting XSS attacks via a crafted object...

CA AWI 12.0 / 12.1 / 12.2 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross-site scripting product: CA Automic Workload Automation Web Interface AWI formerly Automic Automation Engine, UC4 vulnerable version: 12.0, 12.1, 12.2 fixed version:...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19634

CVE-2018-19634 affects CA Service Desk Manager versions 14.1 and 17. A vulnerability could allow a malicious actor to access survey information. Public sources list impact and attribution, with NVD noting network access and no authentication required (CVSSv3.1: 7.5, HIGH; Confidentiality impact H...