CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2022-22330
https://notcve.org/view.php?id=CVE-2022-22330
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126. IBM Control Desk versión 7.6.1, podría permitir a un atacante remoto obtener información confidencial, causada por el fallo en la configuración del flag HTTPOnly. Un atacante remoto podría aprovechar esta vulnerabilidad para obtener información confidencial de la cookie. • https://exchange.xforce.ibmcloud.com/vulnerabilities/219126 https://www.ibm.com/support/pages/node/6619739 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2022-22329
https://notcve.org/view.php?id=CVE-2022-22329
IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 219124. IBM Control Desk versión 7.6.1, no establece el atributo de seguridad en los tokens de autorización o las cookies de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/219124 https://www.ibm.com/support/pages/node/6619739 •
CVSS: 8.2EPSS: 0%CPEs: 42EXPL: 0CVE-2020-4409
https://notcve.org/view.php?id=CVE-2020-4409
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537. IBM Maximo Asset Management versiones 7.6.0 y 7.6.1, podrían permitir a un atacante remoto conducir ataques de phishing usando un ataque de tabnabbing. • https://exchange.xforce.ibmcloud.com/vulnerabilities/179537 https://www.ibm.com/support/pages/node/6333091 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 43EXPL: 0CVE-2019-4749
https://notcve.org/view.php?id=CVE-2019-4749
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308. IBM Maximo Asset Management versión 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista, conllevando potencialmente a una divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/173308 https://www.ibm.com/support/pages/node/6193479 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 0CVE-2019-4644
https://notcve.org/view.php?id=CVE-2019-4644
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880. IBM Maximo Asset Management versión 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista, conllevando a una divulgación de credenciales en una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/170880 https://www.ibm.com/support/pages/node/6191583 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •