CVE-2026-23782

An improper access control vulnerability exists in BMC Control-M/MFT versions 9.0.20 through 9.0.22 . A flaw in an API management endpoint allows unauthenticated users to retrieve both an API identifier and its associated secret value. An attacker can leverage these exposed secrets to execute pri...

CVE-2026-23781

The BMC Control-M/MFT software (versions 9.0.20 through 9.0.22 ) is vulnerable to unauthorized access due to hardcoded default debug user credentials stored in cleartext within the application package. If these credentials remain unchanged, an attacker can easily obtain them to access the MFT API...

PT-2026-31937

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface...

PT-2026-31922

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to...

CVE-2026-23781: Use of Hard-coded Credentials

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface...

CVE-2026-23782: Improper Access Control

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to...

CVE-2026-23780: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable...

The vulnerability of the ntfs_read_mft() function in the fs/ntfs3/inode.c module of the NTFS file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ntfsreadmft function in the fs/ntfs3/inode.c module of the NTFS file system in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the ntfs_read_mft() function in the fs/ntfs3/inode.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ntfsreadmft function in the fs/ntfs3/inode.c module of the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability may allow a remote attacker to cause a service failure...

PT-2025-54290

3/ Cl0p gang exploits vulnerabilities like CVE-2023-22962 in GoAnywhere MFT. Their focus on data exfiltration has impacted global companies. Cl0p InfoSec...

EUVD-2022-55857

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

CVE-2022-50841

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

UBUNTU-CVE-2022-50841

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

CVE-2022-50841

The CVE covers a Linux kernel NTFS3 parsing flaw: when parsing MFT attributes, an overflow in the attribute size calculation could let Add2Ptr(attr, asize) exceed bounds, enabling an out-of-bounds memory R/W. The issue has been mitigated by adding an overflow check for attribute sizes in fs/ntfs3...

CVE-2022-50841 fs/ntfs3: Add overflow check for attribute size

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

PT-2025-53959

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0+ Description The Linux kernel contained a flaw in the NTFS3 file system implementation. A calculation involving attribute sizes could result in an integer overflow, potentially leading to out-of-bounds...

CVE-2022-50841: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

SUSE CVE-2023-54077

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix memory leak if ntfsreadmft failed Label ATTRROOT in ntfsreadmft sets isroot = true and ni-niflags |= NIFLAGDIR, then next attr will goto label ATTRALLOC and alloc ni-dir.allocrun. However two states are not always...

EUVD-2022-55822

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add null pointer check for inode operations This adds a sanity check for the iop pointer of the inode which is returned after reading Root directory MFT record. We should check the iop is valid before trying to create t...

CVE-2023-54077

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix memory leak if ntfsreadmft failed Label ATTRROOT in ntfsreadmft sets isroot = true and ni-niflags |= NIFLAGDIR, then next attr will goto label ATTRALLOC and alloc ni-dir.allocrun. However two states are not always...