Aggregates CVE and security vulnerability intelligence across all BMC Software-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk ssrf and vendor risk path handling and related problems; some flaws may lead to vendor impact memory corruption, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2024-1605 | BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201. | [email protected] | 6.6 | 0.20% | 2024-03-18 | 2026-06-17 |
| CVE-2024-1604 | Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201. | [email protected] | 6.4 | 0.49% | 2024-03-18 | 2026-06-17 |
| CVE-2020-35593 | BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. | [email protected] | 7.8 | 0.27% | 2023-09-05 | 2026-06-16 |
| CVE-2017-9453 | BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. | [email protected] | 9.0 | 0.68% | 2023-09-05 | 2026-06-16 |
| CVE-2023-39122 | BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200). | [email protected] | 9.8 | 0.56% | 2023-07-31 | 2026-06-17 |
| CVE-2023-34258 | An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution. | [email protected] | 7.5 | 0.81% | 2023-05-31 | 2026-06-17 |
| CVE-2023-34257 | An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication." | [email protected] | 9.8 | 1.04% | 2023-05-31 | 2026-06-17 |
| CVE-2023-26550 | A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field. | [email protected] | 9.8 | 0.75% | 2023-02-25 | 2026-06-17 |
| CVE-2022-26088 | An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated." | [email protected] | 5.4 | 1.01% | 2022-11-10 | 2026-06-17 |
| CVE-2022-35865 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709. | [email protected] | 9.8 | 1.50% | 2022-08-03 | 2026-06-17 |
| CVE-2022-35864 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CA | [email protected] | 6.5 | 1.38% | 2022-08-03 | 2026-06-17 |
| CVE-2022-24047 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618. | [email protected] | 9.8 | 1.87% | 2022-02-18 | 2026-06-17 |
| CVE-2017-17678 | BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility. | [email protected] | 6.1 | 0.59% | 2021-05-19 | 2026-07-08 |
| CVE-2017-17677 | BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code. | [email protected] | 8.8 | 1.05% | 2021-05-19 | 2026-07-08 |
| CVE-2017-17675 | BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data. | [email protected] | 5.3 | 0.86% | 2021-05-19 | 2026-07-08 |
| CVE-2017-17674 | BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE). | [email protected] | 9.8 | 2.08% | 2021-05-19 | 2026-07-08 |
| CVE-2015-5072 | The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary local files via the __imageid parameter. | [email protected] | 6.5 | 1.68% | 2020-01-15 | 2026-06-16 |
| CVE-2015-5071 | AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet. | [email protected] | 6.5 | 1.78% | 2020-01-15 | 2026-06-16 |
| CVE-2019-11216 | BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed. | [email protected] | 6.5 | 1.84% | 2019-12-04 | 2026-06-16 |
| CVE-2019-17044 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution. | [email protected] | 7.8 | 0.39% | 2019-10-14 | 2026-06-16 |