CVE-2011-1653
Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the (1) UnAssignFunctionalRoles, (2)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 88.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the (1) UnAssignFunctionalRoles, (2) UnassignAdminRoles, (3) DeleteFilter, (4) NonAssignedUserList, (5) DeleteReportLayout, (6) DeleteReports, and (7) RegenerateReport stored procedures.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 88.66% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- broadcom/total defense
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/44097Vendor Advisory
- http://securityreason.com/securityalert/8403
- http://securitytracker.com/id?1025353
- http://www.securityfocus.com/archive/1/517489/100/0/threaded
- http://www.securityfocus.com/archive/1/517490/100/0/threaded
- http://www.securityfocus.com/archive/1/517491/100/0/threaded
- http://www.securityfocus.com/archive/1/517493/100/0/threaded
- http://www.securityfocus.com/archive/1/517494/100/0/threaded
- http://www.securityfocus.com/archive/1/517496/100/0/threaded
- http://www.securityfocus.com/archive/1/517497/100/0/threaded
- http://www.securityfocus.com/archive/1/517498/100/0/threaded
- http://www.securityfocus.com/bid/47355
- http://www.vupen.com/english/advisories/2011/0977Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-128/
- http://www.zerodayinitiative.com/advisories/ZDI-11-129/
- http://www.zerodayinitiative.com/advisories/ZDI-11-130/
- http://www.zerodayinitiative.com/advisories/ZDI-11-131/
- http://www.zerodayinitiative.com/advisories/ZDI-11-132/
- http://www.zerodayinitiative.com/advisories/ZDI-11-133/
- http://www.zerodayinitiative.com/advisories/ZDI-11-134/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66725
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D
- http://secunia.com/advisories/44097Vendor Advisory
- http://securityreason.com/securityalert/8403
- http://securitytracker.com/id?1025353
- http://www.securityfocus.com/archive/1/517489/100/0/threaded
- http://www.securityfocus.com/archive/1/517490/100/0/threaded
- http://www.securityfocus.com/archive/1/517491/100/0/threaded
- http://www.securityfocus.com/archive/1/517493/100/0/threaded
- http://www.securityfocus.com/archive/1/517494/100/0/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.