Filtered by vendor Bmc Subscriptions
Filtered by product Control-m Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-1604 1 Bmc 1 Control-m 2024-11-21 6.4 Medium
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
CVE-2023-39122 1 Bmc 1 Control-m 2024-11-21 9.8 Critical
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).
CVE-2023-26550 1 Bmc 1 Control-m 2024-11-21 9.8 Critical
A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.