Export limit exceeded: 11744 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (98 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113688 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information. | ||||
| CVE-2026-113689 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers. | ||||
| CVE-2026-113690 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers. | ||||
| CVE-2026-113691 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers. | ||||
| CVE-2026-113692 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory. | ||||
| CVE-2026-113693 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value. | ||||
| CVE-2026-113694 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users. | ||||
| CVE-2026-113695 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user. | ||||
| CVE-2026-113696 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-31 | N/A |
| Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions. | ||||
| CVE-2026-113697 | 1 Bmc | 1 Bmc Helix Operations Management | 2026-10-31 | N/A |
| Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link. | ||||
| CVE-2026-10537 | 1 Bmc | 2 Control-m/enterprise Manager, Control-m/server | 2026-10-27 | 5.3 Medium |
| A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions | ||||
| CVE-2026-10539 | 1 Bmc | 1 Control-m/server | 2026-07-01 | 9 Critical |
| A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions. | ||||
| CVE-2026-10538 | 1 Bmc | 2 Control-m/enterprise Manager, Control-m/server | 2026-07-01 | 8 High |
| Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content. | ||||
| CVE-2026-10540 | 1 Bmc | 1 Control-m/enterprise Manager | 2026-07-01 | 5.6 Medium |
| The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions | ||||
| CVE-2022-35865 | 1 Bmc | 1 Track-it\! | 2026-06-02 | 9.8 Critical |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709. | ||||
| CVE-2026-23780 | 1 Bmc | 2 Control-m, Control-m\/managed File Transfer | 2026-04-27 | 8.8 High |
| An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution. | ||||
| CVE-2026-23782 | 1 Bmc | 2 Control-m, Control-m\/managed File Transfer | 2026-04-27 | 7.5 High |
| An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access. | ||||
| CVE-2026-23781 | 1 Bmc | 2 Control-m, Control-m\/managed File Transfer | 2026-04-27 | 9.8 Critical |
| An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface. | ||||
| CVE-2007-0310 | 1 Bmc | 1 Remedy Action Request System | 2026-04-23 | N/A |
| BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names. | ||||
| CVE-2008-5982 | 1 Bmc | 1 Patrol Agent | 2026-04-23 | N/A |
| Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log message. | ||||