CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1291
https://notcve.org/view.php?id=CVE-2017-1291
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 125152. Maximo Asset Management versiones 7.5 y 7.6 de IBM, es vulnerable a ataques de división de respuestas HTTP. • http://www.ibm.com/support/docview.wss?uid=swg22003413 https://exchange.xforce.ibmcloud.com/vulnerabilities/125152 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1292
https://notcve.org/view.php?id=CVE-2017-1292
IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153. Las versiones 7.5 y 7.6 de IBM Maximo Asset Management generan mensajes de error que podrían revelar información sensible para futuros ataques contra el sistema. IBM X-Force ID: 125153. • http://www.ibm.com/support/docview.wss?uid=swg22003414 https://exchange.xforce.ibmcloud.com/vulnerabilities/125153 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.4EPSS: 1%CPEs: 5EXPL: 0CVE-2016-9976
https://notcve.org/view.php?id=CVE-2016-9976
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252. IBM Maximo Asset Management 7.1, 7.5, y 7.6 podría permitir a un atacante remoto incluir ficheros arbitrarios. Un atacante remoto podría enviar peticiones URL especialmente diseñadas para ejecutar código abritrario en el servidor afectado. • http://www.ibm.com/support/docview.wss?uid=swg22002018 http://www.securityfocus.com/bid/98305 • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8924
https://notcve.org/view.php?id=CVE-2016-8924
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podrían permitir a un atacante remoto secuestrar la sesión de un usuario debido a un error de validación del identificador de sesión. • http://www.ibm.com/support/docview.wss?uid=swg21996256 http://www.securityfocus.com/bid/98023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 21EXPL: 1CVE-2015-0104 – IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-0104
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors. IBM Tivoli IT Asset Management para IT, Tivoli Service Request Manager, y Change y Configuration Management Database 7.1 en versiones hasta 7.1.1.8 y 7.2 y Maximo Asset Management y Maximo Industry Solutions 7.1 en versiones hasta 7.1.1.8, 7.5 en versiones anteriores a 7.5.0.7 IFIX003, y 7.6 en versiones anteriores a 7.6.0.0 IFIX002 permite a los usuarios autenticados remotos ejecutar código arbitrario a través de vectores no especificados. • https://www.exploit-db.com/exploits/36002 http://www-01.ibm.com/support/docview.wss?uid=swg21694974 http://www.securityfocus.com/bid/97999 • CWE-284: Improper Access Control •