Code injection

The management.asmx module in the Management Web Service in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and...

Sql injection

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1654

Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense TD r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to...

Directory traversal

Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense TD r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to...

CVE-2011-1653

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1655

CA Total Defense Suite UNCWS getDBConfigSettings vulnerability (CVE-2011-1655) affects UNC Server before SE2; management.asmx responds to SOAP requests and transmits database credentials in plaintext, enabling unauthenticated remote access to credentials and potential arbitrary code execution. Im...

CVE-2011-1653

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1655

The management.asmx module in the Management Web Service in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and...

CVE-2011-1653

CA Total Defense UNCWS SQL Injection vulnerabilities (CVE-2011-1653) affect the Unified Network Control (UNC) Server in CA Total Defense Suite R12 pre-SE2. The issues arise from insufficient validation of request parameters in several UNCWS stored procedures (including DeleteReports and related f...

CVE-2011-1654

CVE-2011-1654 affects CA Total Defense Suite (r12) prior to SE2, via the Heartbeat Web Service (CA.Itm.Server.ManagementWS.dll) in the Management Server . An unauthenticated remote attacker can craft an upload to FileUploadHandler.ashx with malicious GUID parameter, enabling arbitrary code execut...

CVE-2011-1654

Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense TD r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to...

CVE-2011-1653: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the 1 UnAssignFunctionalRoles, 2 UnassignAdminRoles, 3 DeleteFilter, 4 NonAssignedUserList, 5...

CVE-2011-1654: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense TD r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to...

CVE-2011-1655: Undefined Security Weakness

The management.asmx module in the Management Web Service in the Unified Network Control UNC Server in CA Total Defense TD r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and...

PT-2011-3269

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description The issue allows remote attackers to obtain database credentials by sniffing the network, due to the management.asmx module in the Management Web Service sending a cleartext response to...

PT-2011-3267

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description The issue involves multiple SQL injection vulnerabilities in the Unified Network Control UNC Server. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via...

PT-2011-3268

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2 Description A directory traversal issue exists in the Heartbeat Web Service, allowing remote attackers to execute arbitrary code. This is achieved by using directory traversal sequences in the GUID...

CA Total Defense Suite UNC Management Console DeleteFilter SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite Unified Network Control Management Console. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeleteFilter stored procedure,...

CA Total Defense Suite UNC Management Console DeleteReportLayout SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeleteReportLayout stored procedure, accessed via the management.asmx...

CA Total Defense Suite UNC Management Console RegenerateReport SQL Injection Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Suite r12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RegenerateReport stored procedure, accessed via the management.asmx...