Authentication flaw

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

Xxe

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CA Cloud Service Management CSM before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8471

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors...

CVE-2014-8472

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-8471

CVE-2014-8471 affects CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade, where replay attacks were possible via unspecified vectors. The Security Notice confirms four related vulnerabilities and states they were fixed in the Cloud Service Management Summer 2014 Upgrade, addressin...

CVE-2014-8472

CVE-2014-8472 affects CA Cloud Service Management prior to the Summer 2014 upgrade, where authentication tokens from an Identity Provider were not properly verified. This allowed a user-assisted remote attacker to bypass access restrictions via unspecified vectors. The issue was addressed in the ...

CVE-2014-8473

CVE-2014-8473 describes a cross-site request forgery vulnerability in CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade. The flaw could allow remote attackers to hijack user sessions via unspecified vectors. The Security Notice (CA Technologies) states this issue was fixed in the...

CVE-2014-8474

CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade is affected by CVE-2014-8474, an XML External Entity (XXE) vulnerability. An attacker could exploit an XML document containing an external entity declaration and an entity reference to read arbitrary files, launch requests to intr...

PT-2014-8544

Name of the Vulnerable Software and Affected Versions CA Cloud Service Management CSM versions prior to Summer 2014 Description The issue allows remote attackers to conduct replay attacks. Recommendations For versions prior to Summer 2014, update to a version released after Summer 2014 to resolve...

PT-2014-8545

Name of the Vulnerable Software and Affected Versions CA Cloud Service Management CSM versions prior to Summer 2014 Description The issue allows user-assisted remote attackers to bypass intended access restrictions. This is due to the improper verification of authentication tokens from an Identit...

PT-2014-8546

Name of the Vulnerable Software and Affected Versions CA Cloud Service Management CSM versions prior to Summer 2014 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For CA Cloud Service...

PT-2014-8547

Name of the Vulnerable Software and Affected Versions CA Cloud Service Management CSM versions prior to Summer 2014 Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML...

CVE-2014-8471: Undefined Security Weakness

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors...

CVE-2014-8472: Improper Authentication

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-8474: Undefined Security Weakness

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

CVE-2014-8473: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CA Cloud Service Management CSM before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)

Two classes of persistent XSS issues we reported in IBM Maximo a month or two back are now fixed: http://www.pentestpartners.com/blog/further-ibm-maximo-asset-management-vulnerabilities-reported/ Individual bulletins linked from the above, but tl;dr is I would suggest patching, as this could...

Multiple CA Service Management Products Unspecified Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33161/info Multiple CA Service Management products are prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue is the result of insufficient access restrictions. Successful attacks c...

HP Service Manager WebTier and Windows Client未明代码执行漏洞

CVE ID:CVE-2013-6197 HP Service Manager是一款软件即服务可以帮助您迅速部署一个全面的IT 服务管理解决方案。 HP Service Manager WebTier and Windows Client存在未明安全漏洞，允许通过验证的远程用户执行任意代码。 0 HP Service Manager WebTier and Windows Client 9.20 HP Service Manager WebTier and Windows Client 9.21 厂商补丁： HP ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...