Filtered by vendor Bmc
Subscribe
Total
59 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2007-1972 | 1 Bmc | 1 Performance Manager | 2025-04-09 | 7.5 HIGH | N/A |
| PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured | |||||
| CVE-2007-0310 | 1 Bmc | 1 Remedy Action Request System | 2025-04-09 | 5.0 MEDIUM | N/A |
| BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names. | |||||
| CVE-2008-5982 | 1 Bmc | 1 Patrol Agent | 2025-04-09 | 10.0 HIGH | N/A |
| Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log message. | |||||
| CVE-1999-1459 | 1 Bmc | 1 Patrol Agent | 2025-04-03 | 7.2 HIGH | N/A |
| BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file. | |||||
| CVE-1999-0443 | 1 Bmc | 1 Patrol Agent | 2025-04-03 | 10.0 HIGH | N/A |
| Patrol management software allows a remote attacker to conduct a replay attack to steal the administrator password. | |||||
| CVE-1999-0801 | 1 Bmc | 1 Patrol Agent | 2025-04-03 | 10.0 HIGH | N/A |
| BMC Patrol allows remote attackers to gain access to an agent by spoofing frames. | |||||
| CVE-1999-1460 | 1 Bmc | 1 Patrol Agent | 2025-04-03 | 7.2 HIGH | N/A |
| BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program. | |||||
| CVE-1999-0921 | 1 Bmc | 1 Patrol Agent | 2025-04-03 | 5.0 MEDIUM | N/A |
| BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service. | |||||
| CVE-2005-3311 | 1 Bmc | 1 Software Control-m Agent | 2025-04-03 | 2.1 LOW | N/A |
| BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||||
| CVE-2023-26550 | 1 Bmc | 1 Control-m | 2025-03-11 | N/A | 9.8 CRITICAL |
| A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field. | |||||
| CVE-2023-34257 | 1 Bmc | 1 Patrol Agent | 2025-01-10 | N/A | 9.8 CRITICAL |
| An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication." | |||||
| CVE-2023-34258 | 1 Bmc | 1 Patrol | 2025-01-08 | N/A | 7.5 HIGH |
| An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution. | |||||
| CVE-2023-39122 | 1 Bmc | 1 Control-m | 2024-11-21 | N/A | 9.8 CRITICAL |
| BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200). | |||||
| CVE-2022-35865 | 1 Bmc | 1 Track-it\! | 2024-11-21 | N/A | 9.8 CRITICAL |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709. | |||||
| CVE-2022-35864 | 1 Bmc | 1 Track-it\! | 2024-11-21 | N/A | 6.5 MEDIUM |
| This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690. | |||||
| CVE-2022-26088 | 1 Bmc | 1 Remedy It Service Management Suite | 2024-11-21 | N/A | 5.4 MEDIUM |
| An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated." | |||||
| CVE-2022-24047 | 1 Bmc | 1 Track-it\! | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618. | |||||
| CVE-2020-35593 | 1 Bmc | 1 Patrol Agent | 2024-11-21 | N/A | 7.8 HIGH |
| BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. | |||||
| CVE-2019-8352 | 1 Bmc | 1 Patrol Agent | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network. | |||||
| CVE-2019-17044 | 2 Bmc, Linux | 2 Patrol Agent, Linux Kernel | 2024-11-21 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution. | |||||