Project Portfolio Management

DATE	CVE	VULNERABILITY TITLE	RISK
2018-08-30	CVE-2018-13826	XXE vulnerability in multiple products An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks. network low complexity ca broadcom CWE-611 critical	9.1
2018-08-30	CVE-2018-13825	Cross-site Scripting vulnerability in multiple products Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks. network low complexity ca broadcom CWE-79	6.1
2018-08-30	CVE-2018-13824	SQL Injection vulnerability in multiple products Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks. network low complexity ca broadcom CWE-89 critical	9.8
2018-08-30	CVE-2018-13823	XXE vulnerability in multiple products An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information. network low complexity ca broadcom CWE-611	7.5
2018-08-30	CVE-2018-13822	Insufficiently Protected Credentials vulnerability in Broadcom Project Portfolio Management Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information. network low complexity broadcom CWE-522	7.5