CVE-2016-5063

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/93948Third Party Advisory, VDB Entry
https://docs.bmc.com/docs/display/bsa87/Notification+of+Windows+RSCD+Agent+vulnerability+in+BMC+Server+Automation+CVE-2016-5063Mitigation, Vendor Advisory
https://www.exploit-db.com/exploits/43902/
https://www.exploit-db.com/exploits/43934/
http://www.securityfocus.com/bid/93948Third Party Advisory, VDB Entry
https://docs.bmc.com/docs/display/bsa87/Notification+of+Windows+RSCD+Agent+vulnerability+in+BMC+Server+Automation+CVE-2016-5063Mitigation, Vendor Advisory
https://www.exploit-db.com/exploits/43902/
https://www.exploit-db.com/exploits/43934/

Timeline

Published: May 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50659.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.CVE-2016-50669.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.CVE-2016-50678.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.CVE-2016-50689.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.CVE-2016-50699.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.CVE-2016-50709.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.CVE-2016-50718.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.CVE-2016-50728.8OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions CVE-2016-50736.1CloudView NMS before 2.10a has XSS via SNMP.CVE-2016-50749.8CloudView NMS before 2.10a has a format string issue exploitable over SNMP.CVE-2016-50756.1CloudView NMS before 2.10a has XSS via a TELNET login.CVE-2016-50767.5CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.