https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-28250.htmlhttps://patchthecve.com/cve/CVE-2021-28250.htmlWed, 17 Jun 2026 03:46:06 +0000HIGH 7.8: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that arehttps://patchthecve.com/cve/CVE-2021-28249.htmlhttps://patchthecve.com/cve/CVE-2021-28249.htmlWed, 17 Jun 2026 03:46:06 +0000HIGH 8.8: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. https://patchthecve.com/cve/CVE-2021-28247.htmlhttps://patchthecve.com/cve/CVE-2021-28247.htmlWed, 17 Jun 2026 03:46:05 +0000MEDIUM 5.4: CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the plhttps://patchthecve.com/cve/CVE-2019-7394.htmlhttps://patchthecve.com/cve/CVE-2019-7394.htmlWed, 17 Jun 2026 02:40:33 +0000HIGH 8.8: A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an ahttps://patchthecve.com/cve/CVE-2019-7393.htmlhttps://patchthecve.com/cve/CVE-2019-7393.htmlWed, 17 Jun 2026 02:40:33 +0000MEDIUM 4.3: A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.https://patchthecve.com/cve/CVE-2018-19635.htmlhttps://patchthecve.com/cve/CVE-2018-19635.htmlWed, 17 Jun 2026 01:49:38 +0000CRITICAL 9.8: CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.https://patchthecve.com/cve/CVE-2018-19634.htmlhttps://patchthecve.com/cve/CVE-2018-19634.htmlWed, 17 Jun 2026 01:49:38 +0000HIGH 7.5: CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.https://patchthecve.com/cve/CVE-2018-13826.htmlhttps://patchthecve.com/cve/CVE-2018-13826.htmlWed, 17 Jun 2026 01:40:14 +0000CRITICAL 9.1: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.https://patchthecve.com/cve/CVE-2018-13825.htmlhttps://patchthecve.com/cve/CVE-2018-13825.htmlWed, 17 Jun 2026 01:40:14 +0000MEDIUM 6.1: Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.https://patchthecve.com/cve/CVE-2018-13824.htmlhttps://patchthecve.com/cve/CVE-2018-13824.htmlWed, 17 Jun 2026 01:40:14 +0000CRITICAL 9.8: Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.https://patchthecve.com/cve/CVE-2018-13823.htmlhttps://patchthecve.com/cve/CVE-2018-13823.htmlWed, 17 Jun 2026 01:40:14 +0000HIGH 7.5: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.https://patchthecve.com/cve/CVE-2018-13821.htmlhttps://patchthecve.com/cve/CVE-2018-13821.htmlWed, 17 Jun 2026 01:40:14 +0000CRITICAL 9.8: A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.https://patchthecve.com/cve/CVE-2018-13820.htmlhttps://patchthecve.com/cve/CVE-2018-13820.htmlWed, 17 Jun 2026 01:40:14 +0000HIGH 7.5: A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.https://patchthecve.com/cve/CVE-2018-13819.htmlhttps://patchthecve.com/cve/CVE-2018-13819.htmlWed, 17 Jun 2026 01:40:13 +0000HIGH 7.5: A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.https://patchthecve.com/cve/CVE-2018-9027.htmlhttps://patchthecve.com/cve/CVE-2018-9027.htmlWed, 17 Jun 2026 02:05:56 +0000MEDIUM 6.1: A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with a specially crafted link.https://patchthecve.com/cve/CVE-2018-6589.htmlhttps://patchthecve.com/cve/CVE-2018-6589.htmlWed, 17 Jun 2026 02:02:03 +0000HIGH 7.5: CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors.https://patchthecve.com/cve/CVE-2018-8954.htmlhttps://patchthecve.com/cve/CVE-2018-8954.htmlWed, 17 Jun 2026 02:05:43 +0000CRITICAL 9.8: CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.https://patchthecve.com/cve/CVE-2018-8953.htmlhttps://patchthecve.com/cve/CVE-2018-8953.htmlWed, 17 Jun 2026 02:05:42 +0000HIGH 8.8: CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.https://patchthecve.com/cve/CVE-2018-6588.htmlhttps://patchthecve.com/cve/CVE-2018-6588.htmlWed, 17 Jun 2026 02:02:03 +0000MEDIUM 6.1: CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.https://patchthecve.com/cve/CVE-2018-6587.htmlhttps://patchthecve.com/cve/CVE-2018-6587.htmlWed, 17 Jun 2026 02:02:03 +0000MEDIUM 6.1: CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.https://patchthecve.com/cve/CVE-2018-6586.htmlhttps://patchthecve.com/cve/CVE-2018-6586.htmlWed, 17 Jun 2026 02:02:03 +0000MEDIUM 6.1: CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing.https://patchthecve.com/cve/CVE-2017-9394.htmlhttps://patchthecve.com/cve/CVE-2017-9394.htmlWed, 17 Jun 2026 01:28:02 +0000MEDIUM 5.4: A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user.https://patchthecve.com/cve/CVE-2017-9393.htmlhttps://patchthecve.com/cve/CVE-2017-9393.htmlWed, 17 Jun 2026 01:28:01 +0000CRITICAL 9.8: CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.https://patchthecve.com/cve/CVE-2017-8391.htmlhttps://patchthecve.com/cve/CVE-2017-8391.htmlWed, 17 Jun 2026 01:26:18 +0000MEDIUM 5.5: The OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1 places an encrypted password into a readable local file during operating system installation, which allows local users to obtain sensitive information by reading this file after operating system installationhttps://patchthecve.com/cve/CVE-2016-9165.htmlhttps://patchthecve.com/cve/CVE-2016-9165.htmlWed, 17 Jun 2026 00:55:37 +0000HIGH 7.5: The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges vihttps://patchthecve.com/cve/CVE-2016-9164.htmlhttps://patchthecve.com/cve/CVE-2016-9164.htmlWed, 17 Jun 2026 00:55:36 +0000HIGH 7.5: Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to read arbitrary files via unspecified vectors.https://patchthecve.com/cve/CVE-2016-9148.htmlhttps://patchthecve.com/cve/CVE-2016-9148.htmlWed, 17 Jun 2026 00:55:35 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM parameter.https://patchthecve.com/cve/CVE-2016-9795.htmlhttps://patchthecve.com/cve/CVE-2016-9795.htmlWed, 17 Jun 2026 00:56:33 +0000HIGH 7.8: The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Performance for Infrastructure Managers 12.8 and 12.9; CA Universal Job Management Agent 11.2; CA Virtual Assurance for Infrastructure Managers 12.8 and 12.9; CA Wohttps://patchthecve.com/cve/CVE-2016-10086.htmlhttps://patchthecve.com/cve/CVE-2016-10086.htmlWed, 17 Jun 2026 00:39:01 +0000HIGH 8.1: RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request.https://patchthecve.com/cve/CVE-2016-6152.htmlhttps://patchthecve.com/cve/CVE-2016-6152.htmlWed, 17 Jun 2026 00:50:32 +0000HIGH 8.8: CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.https://patchthecve.com/cve/CVE-2016-6151.htmlhttps://patchthecve.com/cve/CVE-2016-6151.htmlWed, 17 Jun 2026 00:50:32 +0000HIGH 8.8: CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.https://patchthecve.com/cve/CVE-2015-3318.htmlhttps://patchthecve.com/cve/CVE-2015-3318.htmlWed, 17 Jun 2026 00:25:43 +0000MEDIUM 4.6: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6https://patchthecve.com/cve/CVE-2015-3317.htmlhttps://patchthecve.com/cve/CVE-2015-3317.htmlWed, 17 Jun 2026 00:25:43 +0000MEDIUM 4.6: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6https://patchthecve.com/cve/CVE-2015-3316.htmlhttps://patchthecve.com/cve/CVE-2015-3316.htmlWed, 17 Jun 2026 00:25:43 +0000MEDIUM 4.6: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6https://patchthecve.com/cve/CVE-2014-2210.htmlhttps://patchthecve.com/cve/CVE-2014-2210.htmlWed, 17 Jun 2026 00:06:14 +0000HIGH 7.5: Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors.https://patchthecve.com/cve/CVE-2013-5968.htmlhttps://patchthecve.com/cve/CVE-2013-5968.htmlTue, 16 Jun 2026 23:59:49 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject arbitrary web script or HTML via vectors involving a " (double quote) character.https://patchthecve.com/cve/CVE-2012-6299.htmlhttps://patchthecve.com/cve/CVE-2012-6299.htmlTue, 16 Jun 2026 23:47:58 +0000HIGH 10.0: Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to bypass intended access restrictions via unknown vectors.https://patchthecve.com/cve/CVE-2012-6298.htmlhttps://patchthecve.com/cve/CVE-2012-6298.htmlTue, 16 Jun 2026 23:47:58 +0000HIGH 10.0: Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to execute arbitrary commands or modify data via unknown vectors.https://patchthecve.com/cve/CVE-2012-5973.htmlhttps://patchthecve.com/cve/CVE-2012-5973.htmlTue, 16 Jun 2026 23:47:39 +0000HIGH 10.0: CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request.https://patchthecve.com/cve/CVE-2010-5156.htmlhttps://patchthecve.com/cve/CVE-2010-5156.htmlTue, 16 Jun 2026 23:26:12 +0000MEDIUM 6.2: Race condition in CA Internet Security Suite Plus 2010 6.0.0.272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes d