CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35593
https://notcve.org/view.php?id=CVE-2020-35593
BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. BMC PATROL Agent hasta 20.08.00 permite la escalada de privilegios locales a través de vectores que involucran pconfig +RESTART -host. • http://web.archive.org/web/20210106175128/https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593 https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593 https://webapps.bmc.com/support/faces/az/prodallversions.jsp?seqid=304517 https://www.securifera.com/advisories https://www.securifera.com/blog/2021/03/08/bmc-patrol-agent-domain-user-to-domain-admin-part-2 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34257
https://notcve.org/view.php?id=CVE-2023-34257
An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication." • https://www.errno.fr/PatrolAdvisory.html#remote-code-excution-using-patrols-pconfig •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8352 – IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8352
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network. Por defecto, BMC PATROL Agent hasta el 11.3.01 usa una Clave de Cifrado estática para cifrar / descifrar las credenciales de usuario enviadas a través de la red a los servicios administrados de PATROL Agent. Si un atacante pudiera capturar este tráfico de red, podría descifrar estas credenciales y usarlas para ejecutar código o escalar privilegios en la red. • https://www.exploit-db.com/exploits/46969 https://www.securifera.com/advisories/CVE-2019-8352 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 6%CPEs: 1EXPL: 2CVE-2018-20735 – BMC Patrol Agent - Privilege Escalation Code Execution Execution
https://notcve.org/view.php?id=CVE-2018-20735
An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. • https://www.exploit-db.com/exploits/46556 https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin • CWE-287: Improper Authentication •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2591 – BMC Patrol For AIX Insecure RPATH Use
https://notcve.org/view.php?id=CVE-2014-2591
Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting. Vulnerabilidad de búsqueda de ruta no confiable en BMC Patrol para AIX 3.9.00 permite a usuarios locales ganar privilegios a través de una libraría manipulada, relacionado con una configuración RPATH incorrecta. It has been identified that binaries that are executed with elevated privileges (SetGID and SetUID programs) have been compiled in manner that means they searched for libraries in insecure locations. Version 3.9.00 of BMC Patrol for AIX is affected. • http://seclists.org/fulldisclosure/2014/Apr/199 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2591 •