Gabriele Duchi

Name of the Vulnerable Software and Affected Versions: BMC Remedy Mid Tier version 7.6.04 Description: The web application in BMC Remedy Mid Tier allows stored HTML Injection by authenticated remote attackers. Recommendations: For BMC Remedy Mid Tier version 7.6.04, consider restricting access to the web application until a patch is available. As a temporary workaround, limit the ability of authenticated remote attackers to inject HTML code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BMC Remedy Mid Tier version 7.6.04 **Description** An issue was discovered that allows an unauthenticated remote attacker to access any user account without using a password. This issue affects products that are no longer supported by the maintainer. **Recommendations** For BMC Remedy Mid Tier version 7.6.04, consider disabling remote access or restricting user account access until a resolution can be determined, however, since this version is no longer supported, at the moment, there is no information about a newer version that contains a fix for this vulnerability.