Ca Service Desk Manager vulnerabilities

4 CVEs affecting Ca Service Desk Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-19635, published 2019-01-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-9148, published 2017-03-07. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM…
CVE-2016-10086, published 2017-01-18. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions…
CVE-2018-19634, published 2019-01-22. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.
CVE-2018-19635, published 2019-01-22. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.