CVE-2022-35864

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.

• CWE-89

• https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It-Version-2Patch, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-967/Third Party Advisory, VDB Entry
• https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It-Version-2Patch, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-967/Third Party Advisory, VDB Entry

Published

Aug 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35851An improper neutralization of input during web page generati…5.4
• CVE-2022-35857kvf-admin through 2022-02-12 allows remote attackers to exec…9.8
• CVE-2022-35858The TEE_PopulateTransientObject and __utee_from_attr functio…7.8
• CVE-2022-3586A flaw was found in the Linux kernel’s networking code. A us…5.5
• CVE-2022-35860Missing AES encryption in Corsair K63 Wireless 3.1.3 allows …6.8
• CVE-2022-35861pyenv 1.2.24 through 2.3.2 allows local users to gain privil…7.8
• CVE-2022-35865This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-35866This vulnerability allows remote attackers to bypass authent…9.8
• CVE-2022-35867This vulnerability allows local attackers to escalate privil…6.7
• CVE-2022-35868A vulnerability has been identified in TIA Multiuser Server …6.7
• CVE-2022-35869This vulnerability allows remote attackers to bypass authent…9.8
• CVE-2022-3587A vulnerability was found in SourceCodester Simple Cold Stor…5.4