Ca Project Portfolio Management vulnerabilities

4 CVEs affecting Ca Project Portfolio Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-13826, published 2018-08-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-13823, published 2018-08-30. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive…
CVE-2018-13826, published 2018-08-30. Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days. An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request…
CVE-2018-13824, published 2018-08-30. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.
CVE-2018-13825, published 2018-08-30. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected…