CVE-2024-1606

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-16087.5In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application inteCVE-2024-16098.7In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.CVE-2024-16109.8In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.CVE-2024-16187.8A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. ThisCVE-2024-16198.8Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially fCVE-2024-16217.5The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email loCVE-2024-16227.5Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after openingCVE-2024-16237.8Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attackerCVE-2024-16249.4An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPECVE-2024-16256.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized delCVE-2024-16268.1An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project updateCVE-2024-16288.4OS command injection vulnerabilities in GE HealthCare ultrasound devices
CVE-2024-1606: Medium severity, CVSS 5.4 | Vulnix