CVE-2019-7392: Improper Authentication

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration...

Oracle MAF store bypass, a how-to

On a recent assignment I was asked to look at the security of a cloud-based solution for expenses, the Oracle® ExpensesCloud with Fusion applications. It was being used for employees to create/save/edit/submit claims to the employer. TL;DR Having default hardcoded credentials allows an attacker...

PT-2019-18124

Name of the Vulnerable Software and Affected Versions CA Automic Workload Automation versions 12.0 through 12.2 Description The issue is related to insufficient output sanitization in the Automic Web Interface AWI, which could allow attackers to conduct persistent cross-site scripting XSS attacks...

CVE-2019-6504

The CVE-2019-6504 refers to a Cross-Site Scripting (XSS) vulnerability in the Automic Web Interface (AWI) of CA Automic Workload Automation (formerly UC4), due to insufficient output sanitization. Affected are CA Automic Workload Automation versions 12.0 through 12.2, with the issue enabling pers...

CVE-2019-6504: Improper Neutralization of Input During Web Page Generation

Insufficient output sanitization in the Automic Web Interface AWI, in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting XSS attacks via a crafted object...

CA AWI 12.0 / 12.1 / 12.2 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross-site scripting product: CA Automic Workload Automation Web Interface AWI formerly Automic Automation Engine, UC4 vulnerable version: 12.0, 12.1, 12.2 fixed version:...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19634

CVE-2018-19634 affects CA Service Desk Manager versions 14.1 and 17. A vulnerability could allow a malicious actor to access survey information. Public sources list impact and attribution, with NVD noting network access and no authentication required (CVSSv3.1: 7.5, HIGH; Confidentiality impact H...

CVE-2018-19635

CA Service Desk Manager versions 14.1 and 17 contain a privilege-escalation vulnerability in the user interface (CVE-2018-19635). The connected sources confirm the affected product and impact but do not provide exploit vectors, affected components beyond the UI, root cause specifics, or a publish...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

PT-2019-9881

Name of the Vulnerable Software and Affected Versions CA Service Desk Manager versions 14.1 through 17 Description A malicious actor can access survey information due to a vulnerability in the software. Recommendations For versions 14.1 through 17, update to a version that contains a fix for this...

PT-2019-9882

Name of the Vulnerable Software and Affected Versions CA Service Desk Manager versions 14.1 through 17 Description A malicious actor can escalate privileges in the user interface due to a vulnerability. Recommendations For CA Service Desk Manager versions 14.1 through 17, at the moment, there is ...

CVE-2018-19634: Improper Access Control

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635: Improper Privilege Management

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

Authentication Bypass

pki-core is vulnerable to authentication bypass attacks. The vulnerability exists as it was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the...