CVE-2011-1654

CVE-2011-1654 affects CA Total Defense Suite (r12) prior to SE2, via the Heartbeat Web Service (CA.Itm.Server.ManagementWS.dll) in the Management Server . An unauthenticated remote attacker can craft an upload to FileUploadHandler.ashx with malicious GUID parameter, enabling arbitrary code execut...

CVE-2011-1653

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1653: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1654: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense TD r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to...

CVE-2011-1655: Undefined Security Weakness

The management.asmx module in the Management Web Service in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and...

SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion / Edit

Exploit Title: SQL-Ledger = 2.8.33 Post-authentication Local File Include/Edit Vulnerability Google Dork: inurl:/sql-ledger/login.pl Date: April 15, 2011 Author: bitform Software Link: http://www.sql-ledger.com/source/sql-ledger-2.8.33.tar.gz Version: 2.8.33 Tested on: Ubuntu Server 10.04 CVE :...

CentOS 5 : java-1.6.0-openjdk (CESA-2011:0281)

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

java security update

CentOS Errata and Security Advisory CESA-2011:0281 Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scorin...

French Hacker Arrested After Bragging on TV !

A French hacker who boasted on TV about hacking into the network of an important defense contractor was arrested and charged with unauthorized access to a computer system, data theft and organized fraud. The hacker appeared on the France 2 television programme "Complément d'enquête" Further...

PT-2011-3269

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description The issue allows remote attackers to obtain database credentials by sniffing the network, due to the management.asmx module in the Management Web Service sending a cleartext response to...

CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection

This module exploits a SQL injection flaw in CA Total Defense Suite R12. When supplying a specially crafted soap request to '/UNCWS/Management.asmx', an attacker can abuse the reGenerateReports stored procedure by injecting arbitrary sql statements into the ReportIDs element. Module Options msf u...

PT-2011-3267

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description The issue involves multiple SQL injection vulnerabilities in the Unified Network Control UNC Server. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via...

CA Total Defense Suite Heartbeat Web Service Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Endpoint. Authentication is not required to exploit this vulnerability. The specific flaw exists within CA.Itm.Server.ManagementWS.dll. Due to a failure to properly sanitize...

CA Total Defense Suite UNC Management Console DeleteReportLayout SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeleteReportLayout stored procedure, accessed via the management.asmx...

CA Total Defense Suite UNC Management Console DeleteReports SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeleteReports stored procedure, accessed via the management.asmx console. T...

CA Total Defense Suite UNC Management Console RegenerateReport SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite r12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RegenerateReport stored procedure, accessed via the management.asmx...

CA Total Defense Suite UNC Management Console DeleteFilter SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite Unified Network Control Management Console. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeleteFilter stored procedure,...

CA Total Defense Suite UnassignFunctionalUsers Stored Procedure SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UnAssignFunctionalRoles stored procedure, accessed via the management.asmx...

CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management.asmx module of the Management Web Service. This process responds...

PT-2011-3268

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description A directory traversal issue exists in the Heartbeat Web Service, allowing remote attackers to execute arbitrary code. This is achieved by using directory traversal sequences in the GUID...