CA Technologies

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any CA Technologies product.

RSS Feeds for CA Technologies security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in CA Technologies products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by CA Technologies Sorted by Most Security Vulnerabilities since 2018

CA Technologies Privileged Access Manager10 vulnerabilities

CA Technologies Api Developer Portal4 vulnerabilities

CA Technologies Internet Security Suite 20101 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in CA Technologies. CA Technologies did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	0	0.00
2023	0	0.00
2022	0	0.00
2021	5	7.46
2020	0	0.00
2019	8	7.91
2018	27	8.38

It may take a day or so for new CA Technologies vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent CA Technologies Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2021-28246	Mar 26, 2021	CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Ehealth
CVE-2021-28247	Mar 26, 2021	CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS) CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Ehealth Performance Manager
CVE-2021-28248	Mar 26, 2021	CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Ehealth
CVE-2021-28249	Mar 26, 2021	CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Ehealth Performance Manager
CVE-2021-28250	Mar 26, 2021	CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Ehealth Performance Manager
CVE-2019-13658	Oct 02, 2019	CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.	Network Flow Analysis
CVE-2019-13656	Sep 06, 2019	An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.
CVE-2019-7393	May 28, 2019	A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.	Risk Authentication Strong Authentication
CVE-2019-7394	May 28, 2019	A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.	Risk Authentication Strong Authentication
CVE-2019-7392	Feb 26, 2019	An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration.	Privileged Access Manager
CVE-2019-6504	Feb 06, 2019	Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2 Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object.	Automic Workload Automation
CVE-2018-19634	Jan 22, 2019	CA Service Desk Manager 14.1 and 17 contain a vulnerability CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.	Service Desk Manager
CVE-2018-19635	Jan 22, 2019	CA Service Desk Manager 14.1 and 17 contain a vulnerability CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.	Service Desk Manager
CVE-2018-14597	Oct 17, 2018	CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.
CVE-2018-13819	Aug 30, 2018	A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7 A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.	Unified Infrastructure Management
CVE-2018-13820	Aug 30, 2018	A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7 A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.	Unified Infrastructure Management
CVE-2018-13821	Aug 30, 2018	A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7 A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.	Unified Infrastructure Management
CVE-2018-13822	Aug 30, 2018	Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information.	Project Portfolio Management
CVE-2018-13823	Aug 30, 2018	An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.	Project Portfolio Management
CVE-2018-13824	Aug 30, 2018	Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.	Project Portfolio Management
CVE-2018-13825	Aug 30, 2018	Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.	Project Portfolio Management
CVE-2018-13826	Aug 30, 2018	An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.	Project Portfolio Management
CVE-2018-15691	Aug 30, 2018	Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code.	Release Automation
CVE-2018-6590	Aug 03, 2018	CA API Developer Portal 4.x CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.	Ca Api Developer Portal Api Developer Portal
CVE-2018-9021	Jun 18, 2018	An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.	Privileged Access Manager
CVE-2018-9022	Jun 18, 2018	An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.	Privileged Access Manager
CVE-2018-9023	Jun 18, 2018	An input validation vulnerability in CA Privileged Access Manager 2.x An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the update_crld script.	Privileged Access Manager
CVE-2018-9024	Jun 18, 2018	An improper authentication vulnerability in CA Privileged Access Manager 2.x An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file.	Privileged Access Manager
CVE-2018-9025	Jun 18, 2018	An input validation vulnerability in CA Privileged Access Manager 2.x An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input.	Privileged Access Manager
CVE-2018-9026	Jun 18, 2018	A session fixation vulnerability in CA Privileged Access Manager 2.x A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.	Privileged Access Manager
CVE-2018-9027	Jun 18, 2018	A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with a specially crafted link.	Ca Privileged Access Manager
CVE-2018-9028	Jun 18, 2018	Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking. Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.	Privileged Access Manager
CVE-2018-9029	Jun 18, 2018	An improper input validation vulnerability in CA Privileged Access Manager 2.x An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.	Privileged Access Manager
CVE-2015-4664	Jun 18, 2018	An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.	Privileged Access Manager
CVE-2018-6589	May 01, 2018	CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors.	Spectrum
CVE-2018-8953	Apr 11, 2018	CA Workload Automation AE before r11.3.6 SP7 CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.	Workload Automation Ae
CVE-2018-8954	Apr 11, 2018	CA Workload Control Center before r11.4 SP6 CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.	Workload Control Center
CVE-2018-6587	Mar 29, 2018	CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable. CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.	Api Developer Portal
CVE-2018-6586	Mar 29, 2018	CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing. CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing.	Api Developer Portal
CVE-2018-6588	Mar 29, 2018	CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer. CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.	Api Developer Portal
CVE-2017-9394	Nov 14, 2017	A stored cross-site scripting vulnerability in CA Identity Governance 12.6 A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user.
CVE-2017-9393	Sep 22, 2017	CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.
CVE-2016-6152	Jul 26, 2016	CA eHealth 6.2.x and 6.3.x before 6.3.2.13 CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.	Ehealth
CVE-2013-5968	Oct 29, 2013	Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject arbitrary web script or HTML via vectors involving a " (double quote) character.Computer Associates (CA) Reference Link: Advisory https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={9B8E7A8A-2A00-4456-A7CC-8C2E74AA7EA5}	Web Agents
CVE-2010-5156	Aug 25, 2012	Race condition in CA Internet Security Suite Plus 2010 6.0.0.272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code Race condition in CA Internet Security Suite Plus 2010 6.0.0.272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute	Internet Security Suite 2010
CVE-2011-2667	Jul 28, 2011	Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.	Gateway Security
CVE-2011-1718	Apr 27, 2011	The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.	Siteminder
CVE-2009-3587	Oct 13, 2009	Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.	Anti Virus Anti Virus For The Enterprise Anti Virus Gateway And others...
CVE-2009-3588	Oct 13, 2009	Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587.	Anti Virus Anti Virus For The Enterprise Anti Virus Gateway And others...
CVE-2009-0042	Jan 28, 2009	Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus engine for CA Anti-Virus for the Enterprise 7.1, r8, and r8.1; Anti-Virus 2007 v8 and 2008; Internet Security Suite 2007 v3 and 2008; and other CA products Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus engine for CA Anti-Virus for the Enterprise 7.1, r8, and r8.1; Anti-Virus 2007 v8 and 2008; Internet Security Suite 2007 v3 and 2008; and other CA products allow remote attackers to bypass virus detection via a malformed archive file.	Arcserve Backup Common Services Etrust Ez Antivirus And others...