CVE-2023-26550

CVE-2023-26550 affects BMC Control-M prior to 9.0.20.214. The vulnerability is a SQL injection in the memname JSON field that allows an attacker to execute arbitrary SQL commands. The issue is documented with a high severity (CVSS v3.1: 9.8/CRITICAL, network vector, no user interaction, no privil...

CVE-2023-39122

Summary: CVE-2023-39122 affects BMC Control-M ≤ 9.0.20.200, where an SQL injection is possible via the /RF-Server/report/deleteReport endpoint using the report-id parameter. The root cause is a SQL injection vulnerability in that API path. The issue is fixed in version 9.0.21, and is also mitigat...