CVE-2021-28248

CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE:...

CVE-2021-28248

CA eHealth Performance Manager up to version 6.3.2.12 suffers from Improper Restriction of Excessive Authentication Attempts via the /web/frames/ endpoint, allowing an attacker to attempt many passwords and potentially access a targeted account. The maintainer no longer supports this product, and...

CVE-2021-28249

CA eHealth Performance Manager up to version 6.3.2.12 is affected by a Privilege Escalation due to a Dynamically Linked Shared Object Library. An attacker must place a malicious library in the writable RPATH, which is loaded when the FtpCollector executable runs, causing the code in the library t...

CVE-2021-28247

CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting XSS. The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the...

CVE-2021-28247

CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting XSS. The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the...

CVE-2021-28247

CA eHealth Performance Manager (Data Edge) versions up to 6.3.2.12 are affected by a reflected XSS due to improper sanitization. The vulnerability allows an authenticated remote user to inject scripts via endpoints cgi/nhWeb with report, aviewbin/filtermibobjects.pl with namefilter, and aviewbin/...

CVE-2021-28246

CVE-2021-28246 affects CA eHealth Performance Manager up to version 6.3.2.12. The issue is a privilege-escalation defect where a regular user can place a malicious library in the writable RPATH, which is dynamically linked when the emtgtctl2 executable runs, causing the library code to execute wi...

CVE-2021-28246

CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be...

CVE-2021-28247: Improper Neutralization of Input During Web Page Generation

CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting XSS. The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the...

PT-2021-17832 · Ca · Ca Ehealth Performance Manager

Name of the Vulnerable Software and Affected Versions: CA eHealth Performance Manager versions 6.3.2.12 and earlier Description: The issue allows an authenticated remote user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data, performing a Reflected...

Data Edge CA eHealth Performance Manager 跨站脚本漏洞

Data Edge CA eHealth Performance Manager is an application from Data Edge Ireland. It provides real-time and predictive performance analytics to take corrective action before business processes are negatively impacted. A cross-site scripting vulnerability exists in Data Edge CA eHealth Performanc...

CVE-2021-28249: Untrusted Search Path

CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is ru...

Data Edge CA eHealth Performance Manager 安全漏洞

Data Edge CA eHealth Performance Manager is an application from Data Edge Ireland. It provides real-time and predictive performance analytics to take corrective action before business processes are negatively impacted. A security vulnerability exists in Performance Manager through 6.3.2.12, which...

CVE-2021-28248: Improper Restriction of Excessive Authentication Attempts

CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE:...

CVE-2021-28246: Untrusted Search Path

CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be...

CVE-2021-28250: Improper Privilege Management

CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid and/or setgid file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that ar...

OpenSSL: CA Certificate Check Bypass Vulnerability (CVE-2021-3450) - Linux

OpenSSL is prone to a CA certificate check bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

OpenSSL: CA Certificate Check Bypass Vulnerability (CVE-2021-3450) - Windows

OpenSSL is prone to a CA certificate check bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Design/Logic Flaw

The X509VFLAGX509STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an...

CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT

The X509VFLAGX509STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an...