Filtered by vendor Bmc Subscriptions
Filtered by product Remedy Smart Reporting Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-11216 1 Bmc 1 Remedy Smart Reporting 2024-11-21 6.5 Medium
BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.
CVE-2019-1010147 2 Bmc, Yellowfinbi 2 Remedy Smart Reporting, Yellowfin Bi 2024-11-21 N/A
Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.