Bmc
52 CVEs across 34 Bmc products. Browse Bmc vulnerabilities, severities, and proof-of-concept exploits.
Bmc products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10540 | Medium | 5.6 | 2026-07-01 | The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if creden… |
CVE-2026-10539 | Critical | 9.0 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauth… |
CVE-2026-10538 | High | 8.0 | 2026-07-01 | Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Co… |
CVE-2026-23781 | Critical | 9.8 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application pa… |
CVE-2026-23782 | High | 7.5 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier an… |
CVE-2026-23780 | High | 8.8 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated atta… |
CVE-2025-71260 | High | 8.8 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlin… |
CVE-2025-71259 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that… |
CVE-2025-71258 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows… |
CVE-2025-71257 | High | 7.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on re… |
CVE-2025-55108 | Critical | 10.0 | 2025-11-05 | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS… |
CVE-2025-55118 | High | 8.9 | 2025-09-16 | Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: *… |
CVE-2025-55117 | Medium | 5.3 | 2025-09-16 | A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The… |
CVE-2025-55116 | High | 8.8 | 2025-09-16 | A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabil… |
CVE-2025-55115 | High | 8.8 | 2025-09-16 | A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerabilit… |
CVE-2025-55114 | Medium | 5.3 | 2025-09-16 | The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake… |
CVE-2025-55113 | Critical | 9.0 | 2025-09-16 | If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 a… |
CVE-2025-55112 | High | 7.4 | 2025-09-16 | Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cry… |
CVE-2025-55111 | Medium | 5.5 | 2025-09-16 | Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupp… |
CVE-2025-55110 | Medium | 5.5 | 2025-09-16 | Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the… |
CVE-2025-55109 | Critical | 9.0 | 2025-09-16 | An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when… |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2024-34398 | Medium | 4.2 | 2025-03-12 | An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers. |
CVE-2024-34399 | Critical | 9.8 | 2024-09-18 | **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account with… |
CVE-2021-35002 | High | 8.8 | 2024-05-07 | BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2021-35001 | Medium | 6.5 | 2024-05-07 | BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2024-1606 | Medium | 4.6 | 2024-03-18 | Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML… |
CVE-2024-1605 | Medium | 6.6 | 2024-03-18 | BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all… |
CVE-2024-1604 | Medium | 6.4 | 2024-03-18 | Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unautho… |
CVE-2020-35593 | High | 7.8 | 2023-09-05 | BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. |
CVE-2017-9453 | Critical | 9.0 | 2023-09-05 | BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. |
CVE-2023-39122 | Critical | 9.8 | 2023-07-31 | BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by… |
CVE-2023-34258 | High | 7.5 | 2023-05-31 | An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account passwor… |
CVE-2023-34257 | Critical | 9.8 | 2023-05-31 | An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). So… |
CVE-2023-26550 | Critical | 9.8 | 2023-02-25 | A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field. |
CVE-2022-26088 | Medium | 5.4 | 2022-11-10 | An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) i… |
CVE-2022-35865 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to… |
CVE-2022-35864 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is require… |
CVE-2022-24047 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to… |
CVE-2017-17678 | Medium | 6.1 | 2021-05-19 | BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility. |
CVE-2017-17677 | High | 8.8 | 2021-05-19 | BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code. |
CVE-2017-17675 | Medium | 5.3 | 2021-05-19 | BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system… |
CVE-2017-17674 | Critical | 9.8 | 2021-05-19 | BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerabl… |
CVE-2015-5072 | Medium | 6.5 | 2020-01-15 | The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to a… |
CVE-2015-5071 | Medium | 6.5 | 2020-01-15 | AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitr… |
CVE-2019-11216 | Medium | 6.5 | 2019-12-04 | BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to downl… |
CVE-2019-17044 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges… |
CVE-2019-17043 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her… |
CVE-2019-16755 | Critical | 9.8 | 2019-09-26 | BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perform pre-authenticate… |
CVE-2019-1010147 | Medium | 5.4 | 2019-07-26 | Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access… |
CVE-2019-8352 | Critical | 9.8 | 2019-05-20 | By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Ag… |
CVE-2018-18862 | High | 8.8 | 2019-03-21 | BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Detai… |
CVE-2018-20735 | High | 7.8 | 2019-01-17 | An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privi… |
CVE-2018-19505 | Medium | 6.5 | 2019-01-03 | Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the i… |
CVE-2015-9257 | Medium | 6.1 | 2018-03-24 | BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS. |
CVE-2017-18228 | Medium | 5.4 | 2018-03-12 | Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request. |
CVE-2017-18223 | High | 8.1 | 2018-03-10 | BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative access. |
CVE-2016-6599 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a… |
CVE-2016-6598 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a met… |
CVE-2014-9514 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5. |
CVE-2017-13130 | High | 7.8 | 2017-08-23 | mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the… |
CVE-2016-5063 | Medium | 5.3 | 2017-05-02 | The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks an… |
CVE-2016-2349 | High | 7.5 | 2016-12-21 | Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password. |
CVE-2016-4322 | Critical | 9.8 | 2016-12-13 | BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly ha… |
CVE-2016-9638 | High | 7.8 | 2016-12-02 | In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virs… |
CVE-2016-1543 | High | 7.5 | 2016-06-13 | The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypa… |
CVE-2016-1542 | High | 7.5 | 2016-06-13 | The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass a… |
CVE-2014-8270 | | 2014-12-12 | BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a local system accou… | |
CVE-2014-4874 | | 2014-10-10 | BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page. | |
CVE-2014-4873 | | 2014-10-10 | SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via craf… | |
CVE-2014-4872 | | 2014-10-10 | BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or… | |
CVE-2014-2591 | | 2014-05-14 | Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH set… | |
CVE-2013-4946 | | 2013-07-29 | Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML v… | |
CVE-2013-4945 | | 2013-07-29 | Multiple SQL injection vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to execute arbitrary SQL commands via the (1) ASPSESS… | |
CVE-2012-2959 | | 2012-06-11 | Cross-site request forgery (CSRF) vulnerability in password-manager/changePasswords.do in BMC Identity Management Suite 7.5.00.103 allows remote attackers to h… | |
CVE-2011-0975 | | 2011-02-10 | Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance Analysis for Servers, Performance Assurance for Servers, and Performance Assu… | |
CVE-2008-5982 | | 2009-01-27 | Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid vers… | |
CVE-2007-2136 | | 2007-04-22 | Stack-based buffer overflow in bgs_sdservice.exe in BMC Patrol PerformAgent allows remote attackers to execute arbitrary code by connecting to TCP port 10128 a… | |
CVE-2007-1972 | | 2007-04-22 | PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute… | |
CVE-2007-0310 | | 2007-01-18 | BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an i… | |
CVE-2005-3311 | | 2005-10-26 | BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary file… | |
CVE-1999-1460 | | 1999-07-13 | BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument t… | |
CVE-1999-0801 | | 1999-04-09 | BMC Patrol allows remote attackers to gain access to an agent by spoofing frames. | |
CVE-1999-0921 | | 1999-04-01 | BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service. | |
CVE-1999-0443 | | 1999-04-01 | Patrol management software allows a remote attacker to conduct a replay attack to steal the administrator password. | |
CVE-1999-1459 | | 1998-11-02 | BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file. |