peter bassill · operator
$ cve CVE-2011-1653 JSON

CVE-2011-1653 EXPLOIT

10.0
HIGH · CVSS 2.0 · EPSS 88.7% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the (1) UnAssignFunctionalRoles, (2) UnassignAdminRoles, (3) DeleteFilter, (4) NonAssignedUserList, (5) DeleteReportLayout, (6) DeleteReports, and (7) RegenerateReport stored procedures.

Scoring

CVSS10.0 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS88.66% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-89
On CISA KEVno
Public exploityes
Published2011-04-18
Last modified2026-06-16

Affected (1)

VendorProduct
broadcomtotal defense

Public exploits

SourceTitleDate
exploit-dbCA Total Defense Suite - reGenerateReports Stored procedure SQL Injection (Metasploit)2011-10-02

References

→ the Explorer  ·  watch your stack  ·  NVD