Ca Ehealth Performance Manager vulnerabilities

4 CVEs affecting Ca Ehealth Performance Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-28250, published 2021-03-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-0640, published 2010-02-24. Low severity, CVSS 2.6. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager 6.0.x through 6.2.x, when malicious HTML detection is disabled, allows remote attackers to inject arbitrary web script or…
CVE-2021-28247, published 2021-03-26. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect…
CVE-2021-28249, published 2021-03-26. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a…
CVE-2021-28250, published 2021-03-26. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the…