256 matches found
CVE-2024-1604 Incorrect authorization in BMC Control-M
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifi...
CVE-2024-1604 Incorrect authorization in BMC Control-M
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifi...
CVE-2024-1604
CVE-2024-1604 concerns BMC Control-M branches 9.0.20 and 9.0.21 where an improper authorization flaw in the report management/creation module allows logged-in users to read and alter any report without proper permissions, given knowledge of the report identifier. Impact is limited to unauthorized...
BMC Control-M Security Vulnerability
BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M versions 9.0.20 and 9.0.21, which stems from an improper authorization issue in the report management and creation...
BMC Control-M Security Vulnerability
BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M branches versions 9.0.20 and 9.0.21, which originates from a vulnerability that allows a logged-in user to...
BMC Control-M Security Vulnerability
BMC Control-M is an application from BMC Corporation. simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M versions 9.0.20 and 9.0.21, which stems from a vulnerability that allows dynamic link libraries DLLs to be loaded...
CVE-2024-1605: Incorrect Default Permissions
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries DLL from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for...
CVE-2024-1604: Authorization Bypass Through User-Controlled Key
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifi...
CVE-2024-1606: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled b...
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
Sql injection
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
CVE-2023-39122: Improper Neutralization of Special Elements used in an SQL Command
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
BMC Control-M SQL注入漏洞
BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M version v9.0.20.200, which originates from the inclusion of a SQL injection vulnerability via the report-id...
CVE-2023-39122
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 and is also fixed by a patch for 9.0.20.200...
CVE-2023-39122
Summary: CVE-2023-39122 affects BMC Control-M ≤ 9.0.20.200, where an SQL injection is possible via the /RF-Server/report/deleteReport endpoint using the report-id parameter. The root cause is a SQL injection vulnerability in that API path. The issue is fixed in version 9.0.21, and is also mitigat...
PT-2023-26792 · Bmc · Bmc Control-M
Name of the Vulnerable Software and Affected Versions: BMC Control-M versions prior to 9.0.21 BMC Control-M version 9.0.20.200 Description: The issue allows SQL injection via the "/RF-Server/report/deleteReport" API endpoint, specifically through the report-id parameter. Recommendations: For BMC...