CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-1175
https://notcve.org/view.php?id=CVE-2017-1175
IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123297. IBM Máximo Asset Management 7.1, 7.5 y 7.6 es vulnerable a la inyección de sentencias SQL. Un atacante remoto podría enviar sentencias SQL especialmente modificadas, lo que permitiría al atacante ver, añadir modificar o borrar información en el back-end de la base de datos. • http://www.ibm.com/support/docview.wss?uid=swg22005212 http://www.securityfocus.com/bid/99363 https://exchange.xforce.ibmcloud.com/vulnerabilities/123297 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8987
https://notcve.org/view.php?id=CVE-2016-8987
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. Maximo Asset Management versiones 7.1, 7.5 y 7.6 de IBM, podría permitir a un usuario autenticado visualizar un conjunto de elementos inapropiados que no deberían tener acceso para visualización. • http://www.ibm.com/support/docview.wss?uid=swg21996255 http://www.securityfocus.com/bid/97369 https://exchange.xforce.ibmcloud.com/vulnerabilities/119039 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-9977
https://notcve.org/view.php?id=CVE-2016-9977
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253. Maximo Asset Management versiones 7.1, 7.5 y 7.6 de IBM, podría permitir a un atacante remoto secuestrar la sesión de usuario, causado por un fallo para invalidar un identificador de sesión existente. Un atacante podría explotar esta vulnerabilidad para conseguir acceso a la sesión de otro usuario. • http://www.ibm.com/support/docview.wss?uid=swg22003981 http://www.securityfocus.com/bid/98786 https://exchange.xforce.ibmcloud.com/vulnerabilities/120253 • CWE-20: Improper Input Validation •
CVSS: 8.4EPSS: 1%CPEs: 5EXPL: 0CVE-2016-9976
https://notcve.org/view.php?id=CVE-2016-9976
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252. IBM Maximo Asset Management 7.1, 7.5, y 7.6 podría permitir a un atacante remoto incluir ficheros arbitrarios. Un atacante remoto podría enviar peticiones URL especialmente diseñadas para ejecutar código abritrario en el servidor afectado. • http://www.ibm.com/support/docview.wss?uid=swg22002018 http://www.securityfocus.com/bid/98305 • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8924
https://notcve.org/view.php?id=CVE-2016-8924
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podrían permitir a un atacante remoto secuestrar la sesión de un usuario debido a un error de validación del identificador de sesión. • http://www.ibm.com/support/docview.wss?uid=swg21996256 http://www.securityfocus.com/bid/98023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •