CVE-2024-51723

CVE-2024-51723 – BlackBerry AtHoc : A Stored XSS in the Management Console of AtHoc version 7.15 could allow an attacker to execute actions in the context of the victim’s session. Public details in PT-2024-34870 specify the vulnerable component as the Management Console and confirm the issue as a...

CVE-2023-21521

CVE-2023-21521 describes an SQL Injection in the BlackBerry AtHoc 7.15 Management Console (Operator Audit Trail). The affected component is the Management Console’s operator audit trail feature, where user-supplied input can be interpreted as SQL, enabling an attacker to read data from the databa...

CVE-2019-8997

CVE-2019-8997 describes an XML External Entity (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567. An attacker could craft XML in an existing field to read arbitrary local files on the application server or cause outbound requests on the ne...

CVE-2023-21522

CVE-2023-21522 describes a Reflected Cross‑Site Scripting (XSS) weakness in BlackBerry AtHoc 7.15, specifically in the Management Console (Reports). The root cause is reflected input that can be used to execute script in the victim’s browser, running with the context of the affected user account....

CVE-2023-21520

BlackBerry AtHoc 7.15 Self Service Credential Recovery vulnerability enables PII enumeration, potentially allowing an attacker to associate contact details with an AtHoc IWS organization. Affected software/component: AtHoc 7.15 (Self Service Credential Recovery). Root cause unspecified in sources...

CVE-2023-21523

CVE-2023-21523 describes a stored XSS vulnerability in the BlackBerry AtHoc Management Console (User Management and Alerts) affecting version 7.15. The issue allows an attacker to execute script commands in the context of the affected user account. Documented details confirm the vulnerability typ...

CVE-2025-12766

CVE-2025-12766 is a vulnerability in the Management Console of BlackBerry AtHoc (OnPrem) v7.21 where an insecure direct object reference (IDOR) could allow an attacker to gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS). Affected component:...