CVSS: 8.2EPSS: 0%CPEs: 42EXPL: 0CVE-2020-4409
https://notcve.org/view.php?id=CVE-2020-4409
16 Sep 2020 — IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537. IBM Maximo Asset Management versiones 7.6.0 y 7.6.1, ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/179537 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 43EXPL: 0CVE-2019-4749
https://notcve.org/view.php?id=CVE-2019-4749
17 Apr 2020 — IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308. IBM Maximo Asset Management versión 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la f... • https://exchange.xforce.ibmcloud.com/vulnerabilities/173308 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 0CVE-2019-4644
https://notcve.org/view.php?id=CVE-2019-4644
17 Apr 2020 — IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880. IBM Maximo Asset Management versión 7.6, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la f... • https://exchange.xforce.ibmcloud.com/vulnerabilities/170880 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 40EXPL: 0CVE-2019-4446
https://notcve.org/view.php?id=CVE-2019-4446
17 Apr 2020 — IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490. IBM Maximo Asset Management versión 7.6, podría permitir a un usuario autentificado realizar acciones a las que no está autorizado al modificar los parámetros de petición. IBM X-Force ID: 163490. • https://exchange.xforce.ibmcloud.com/vulnerabilities/163490 •
CVSS: 5.4EPSS: 0%CPEs: 18EXPL: 0CVE-2019-4429
https://notcve.org/view.php?id=CVE-2019-4429
19 Feb 2020 — IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162886. IBM Maximo Asset Management versiones 7.6.0 y 7.6.1, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a un usuario insertar código JavaScript arbitrario en la Interfaz de Usuar... • https://exchange.xforce.ibmcloud.com/vulnerabilities/162886 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2018-1528
https://notcve.org/view.php?id=CVE-2018-1528
06 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. IBM X-Force ID: 142290. IBM Maximo Asset Management, desde la versión 7.6 hasta la 7.6.3, podría permitir que un usuario autenticado obtenga información sensible desde la API WhoAmI. IBM X-Force ID: 142290. • http://www.securityfocus.com/bid/105023 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 19EXPL: 0CVE-2018-1524
https://notcve.org/view.php?id=CVE-2018-1524
03 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to the system. This vulnerability is due to an incomplete fix for CVE-2015-4966. IBM X-Force ID: 142116. IBM Maximo Asset Management, de la versión 7.6 a la 7.6.3, se instala con una cuenta de administrador por defecto que podría ser empleada por un atacante remoto para obtener acceso de administrador al sistema. Esta vulnerabilidad existe debido a una sol... • https://exchange.xforce.ibmcloud.com/vulnerabilities/142116 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 0CVE-2016-6072
https://notcve.org/view.php?id=CVE-2016-6072
01 Feb 2017 — IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Maximo Asset Management es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente conduce a ... • http://www.ibm.com/support/docview.wss?uid=swg21991893 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2016-0222
https://notcve.org/view.php?id=CVE-2016-0222
14 Mar 2016 — IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors. IBM Maximo Asset Management 7.6 en versiones anteriores a 7.6.0.3 IFIX001 permite a usuarios remotos autenticados eludir las restricciones de acceso previstas y leer registros de trabajo de órdenes de compra arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21976949 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 119EXPL: 0CVE-2015-7448
https://notcve.org/view.php?id=CVE-2015-7448
12 Mar 2016 — SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección S... • http://www-01.ibm.com/support/docview.wss?uid=swg21974938 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •