CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

CVE-2018-13825

Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks...

CVE-2018-13823

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information...

CVE-2018-15691

Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...

CVE-2018-15691

CVE-2018-15691 affects CA Release Automation NiMi 6.5 and earlier. The root cause is insecure deserialization of a crafted serialized object, permitting potential arbitrary code execution. Documents describe a remote command execution vector via deserialization and note PoC exploits using Commons...

CVE-2018-13825

CA PPM includes a vulnerability in the gridExcelExport feature due to insufficient input validation, enabling reflected XSS. Affected versions: 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below. The root cause is input validation failures in that component; impact is remote e...

CVE-2018-13826

CA PPM XOG module suffers an XML External Entity (XXE) vulnerability that enables server-side request forgery. Affected are CA PPM versions 14.3 and below; 14.4; 15.1; 15.2 CP5 and below; 15.3 CP2 and below. The issue arises in the XOG functionality and is documented across CVE-2018-13826 entries...

CVE-2018-13819

CA Unified Infrastructure Management (UIM) versions 8.5.1, 8.5, and 8.4.7 contain a hardcoded secret key that could allow an attacker to access sensitive information. This CVE (CVE-2018-13819) is corroborated by the NVD entry and the CA/Tenable advisories, which also reference additional vulnerab...

CVE-2018-13826

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks...

CVE-2018-13819

A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information...

CVE-2018-13824

Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks...

CVE-2018-13823

CA PPM versions 14.3 and earlier, 14.4, 15.1, 15.2 CP5 and earlier, and 15.3 CP2 and earlier are affected by an XML External Entity (XXE) vulnerability in the XOG functionality, leading to potential exposure of sensitive information. The issue is caused by XXE in XOG and can be exploited remotely...

CVE-2018-13824

CVE-2018-13824 concerns CA PPM where insufficient input sanitization in two parameters enables SQL injection. Affected versions include CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below. The connected documents consistently describe this as a SQL injection vulnerabilit...

CVE-2018-13822

CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below are affected by CVE-2018-13822 due to unprotected storage of credentials. This allows attackers to access sensitive information. The Connected documents confirm the affected versions and the credential storage issue; no...

CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

CVE-2018-13821

A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing...

CVE-2018-13820

CVE-2018-13820 affects CA Unified Infrastructure Management (UIM) versions 8.5.1, 8.5, and 8.4.7 due to a hardcoded passphrase, which could allow an attacker to access sensitive information. The vulnerability is described across multiple sources (NVD/NVD-derived, CNVD, CNVD-related listings), wit...

CVE-2018-13821

CA Unified Infrastructure Management (UIM) versions 8.5.1, 8.5, and 8.4.7 are affected by CVE-2018-13821 due to a lack of authentication. This allows remote attackers to perform a range of actions, including reading and writing files. The vulnerability is documented in multiple sources (NVD entry...

Hardcoded credentials

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by...

CVE-2018-10936

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by...