Sql injection

SQL injection vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote authenticated users to execute arbitrary SQL commands via a crafted query...

CVE-2014-8246

CA Release Automation (formerly iTKO LISA Release Automation) contains a CSRF vulnerability in CVE-2014-8246 affecting versions up to 4.7.1 Build 413; 4.7.1 Build 448 fixes the issue. The vulnerability allows a remote attacker to perform privileged actions by hijacking an authenticated session vi...

CVE-2014-8248

SQL injection vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote authenticated users to execute arbitrary SQL commands via a crafted query...

CVE-2014-8248

CVE-2014-8248 is a SQL injection in CA Release Automation (formerly iTKO LISA Release Automation) affecting versions up to 4.7.1 before the b448 hotfix. The root cause is insufficient input sanitization in the query path, enabling a remote authenticated user to execute arbitrary SQL. CA issued CA...

CVE-2014-8247

Cross-site scripting XSS vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8246

Cross-site request forgery CSRF vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8247

CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 contains an XSS vulnerability (CVE-2014-8247) caused by insufficient input filtering. Remote attackers could inject arbitrary script/HTML via unspecified vectors, potentially affecting users’ sessions. CA’s security n...

CVE-2014-8247: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8246: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8248: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote authenticated users to execute arbitrary SQL commands via a crafted query...

PT-2014-8439

Name of the Vulnerable Software and Affected Versions CA Release Automation versions prior to 4.7.1 b448 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For versions prior to 4.7.1 b448, update to...

PT-2014-8440

Name of the Vulnerable Software and Affected Versions CA Release Automation versions prior to 4.7.1 b448 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors. Recommendations For versions prior to...

PT-2014-8441

Name of the Vulnerable Software and Affected Versions CA Release Automation versions prior to 4.7.1 b448 Description The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted query. This can be achieved by exploiting a SQL injection vulnerability. Recommendations...

CA LISA Release Automation contains multiple vulnerabilities

Overview CA LISA Release Automation 4.7.1.385 contains multiple vulnerabilities Description CWE-352: Cross-Site Request Forgery CSRF - CVE-2014-8246CA LISA Release Automation 4.7.1.385 contains a global Cross-Site Request Forgery CSRF vulnerability. The application allows a malicious user to...

Multiple packages, Multiple vulnerabilities fixed in 2011

Background For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild. Description Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. FMOD Studio PEAR Mail LVM...

OracleVM 2.2 : openssl (OVMSA-2014-0040) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 2.2 : openssl (OVMSA-2014-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

OracleVM 3.2 : openssl (OVMSA-2014-0039) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet...

CA Brighstor ARCserve Backup Agent Buffer Overflow (CVE-2005-1272)

A stack based buffer overflow vulnerability exists in BrightStor ARCserve and Enterprise Backup Agent for windows. The vulnerability is caused due to a boundary error in the Backup Agents. A remote attacker can exploit this vulnerability to cause a denial of service condition or execute arbitrary...