Xxe

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CA Cloud Service Management CSM before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Authentication flaw

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-8472

CVE-2014-8472 affects CA Cloud Service Management prior to the Summer 2014 upgrade, where authentication tokens from an Identity Provider were not properly verified. This allowed a user-assisted remote attacker to bypass access restrictions via unspecified vectors. The issue was addressed in the ...

CVE-2014-8472

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-8474

CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade is affected by CVE-2014-8474, an XML External Entity (XXE) vulnerability. An attacker could exploit an XML document containing an external entity declaration and an entity reference to read arbitrary files, launch requests to intr...

CVE-2014-8471

CVE-2014-8471 affects CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade, where replay attacks were possible via unspecified vectors. The Security Notice confirms four related vulnerabilities and states they were fixed in the Cloud Service Management Summer 2014 Upgrade, addressin...

CVE-2014-8473

CVE-2014-8473 describes a cross-site request forgery vulnerability in CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade. The flaw could allow remote attackers to hijack user sessions via unspecified vectors. The Security Notice (CA Technologies) states this issue was fixed in the...

CVE-2014-8471

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors...

IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)

Two classes of persistent XSS issues we reported in IBM Maximo a month or two back are now fixed: http://www.pentestpartners.com/blog/further-ibm-maximo-asset-management-vulnerabilities-reported/ Individual bulletins linked from the above, but tl;dr is I would suggest patching, as this could...

Multiple CA Service Management Products Unspecified Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33161/info Multiple CA Service Management products are prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue is the result of insufficient access restrictions. Successful attacks c...

HP Service Manager WebTier and Windows Client未明代码执行漏洞

CVE ID:CVE-2013-6197 HP Service Manager是一款软件即服务可以帮助您迅速部署一个全面的IT 服务管理解决方案。 HP Service Manager WebTier and Windows Client存在未明安全漏洞，允许通过验证的远程用户执行任意代码。 0 HP Service Manager WebTier and Windows Client 9.20 HP Service Manager WebTier and Windows Client 9.21 厂商补丁： HP ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...

CVE-2013-3752

Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect integrity via vectors related to Service Management Facility SMF...

Design/Logic Flaw

Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect integrity via vectors related to Service Management Facility SMF...

CVE-2013-3752

CVE-2013-3752 is a Solaris 11 vulnerability tied to the Service Management Facility (SMF). The Nessus issue bundle notes the Solaris SRU0 patch set for July 2013 addresses an SMF-related flaw affecting Solaris 11, with exploitation via a network vector reported as unauthenticated. The impact desc...

CVE-2013-3752

Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect integrity via vectors related to Service Management Facility SMF...

DEBIAN-CVE-2012-4456

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

HP Business Service Management Remote Code Execution

HP Business Service Management BSM 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444. Recent assessments: wchen-r7 at Septembe...

CA Total Defense UNCWS exportReport SQL Injection

Added: 03/20/2012 OSVDB: 78930 Background CA Total Defense is a combined host-based anti-virus, anti-spyware, firewall, and IPS solution. Problem CA Total Defense includes a web service management component, which in version r12 prior to SE3, fails to validate certain parameters. The exportReport...

CA Total Defense UNCWS exportReport SQL Injection

Added: 03/20/2012 OSVDB: 78930 Background CA Total Defense is a combined host-based anti-virus, anti-spyware, firewall, and IPS solution. Problem CA Total Defense includes a web service management component, which in version r12 prior to SE3, fails to validate certain parameters. The exportReport...