Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: BMC Component: Control-m Clear all filters
TI-2024-01499 CVE-2024-1606 · GHSA-fr8q-pg27-p54p

HTML injection in BMC Control-M

Priority LOW 27

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00432 Published 2024-03-18 Fixed in 9.0.20.238, 9.0.21.200 CWE-80
TI-2024-01498 CVE-2024-1605 · GHSA-wpc3-225m-fg2m

DLL side-loading in BMC Control-M

Priority LOW 33

BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00204 Published 2024-03-18 Fixed in 9.0.20.238, 9.0.21.201 CWE-276
TI-2024-01497 CVE-2024-1604 · GHSA-2wr7-99vr-6m4h

Incorrect authorization in BMC Control-M

Priority LOW 33

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00491 Published 2024-03-18 Fixed in 9.0.20.238, 9.0.21.201 CWE-639