Justin Hocquel

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

يتعرض برنامج Tanium Client لحالة رفض الخدمة. تسمح هذه الثغرة الأمنية بحدوث رفض الخدمة.

توجد ثغرة تتعلق بعدم صحة التحقق من صحة المدخلات في Tanium Appliance.

يوجد في Tanium Threat Response مشكلة تتعلق بتسريب المعلومات.

يحتوي برنامج Tanium Threat Response على ثغرة تتعلق بتسريب المعلومات. تسمح هذه الثغرة باحتمال الكشف عن المعلومات.

تتمثل المشكلة في ثغرة أمنية تتعلق بتجاوز التفويض قد تسمح لمستخدم مسجل الدخول بالوصول إلى بيانات غير مصرح بها مخزنة على Now Platform. يُقدَّر أن أكثر من 481,000 مثيل قد تكون متأثرة.