https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-71260.htmlhttps://patchthecve.com/cve/CVE-2025-71260.htmlThu, 06 Aug 2026 15:21:37 +0000HIGH 8.8: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter thttps://patchthecve.com/cve/CVE-2025-71259.htmlhttps://patchthecve.com/cve/CVE-2025-71259.htmlThu, 06 Aug 2026 15:21:18 +0000MEDIUM 4.3: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of extehttps://patchthecve.com/cve/CVE-2025-71258.htmlhttps://patchthecve.com/cve/CVE-2025-71258.htmlThu, 06 Aug 2026 15:21:28 +0000MEDIUM 4.3: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perforhttps://patchthecve.com/cve/CVE-2025-71257.htmlhttps://patchthecve.com/cve/CVE-2025-71257.htmlThu, 06 Aug 2026 15:21:10 +0000HIGH 7.3: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and https://patchthecve.com/cve/CVE-2008-7158.htmlhttps://patchthecve.com/cve/CVE-2008-7158.htmlTue, 16 Jun 2026 23:03:43 +0000HIGH 10.0: Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) transcriptFile parameter to MRcgi/MRchat.pl or (2) LOADFILE parameter to MRcgi/MRABLoad2.pl. NOTE: some of these details are obtained from third party