CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-9984
https://notcve.org/view.php?id=CVE-2016-9984
13 Jun 2017 — IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force ID: 120276. Maximo Asset Management versiones 7.5 y 7.6 de IBM, podría permitir a un atacante identificado remoto ejecutar comandos arbitrarios en el sistema como administrador. ID de IBM X-Force: 120276. • http://www.ibm.com/support/docview.wss?uid=swg21998608 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8987
https://notcve.org/view.php?id=CVE-2016-8987
08 Jun 2017 — IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. Maximo Asset Management versiones 7.1, 7.5 y 7.6 de IBM, podría permitir a un usuario autenticado visualizar un conjunto de elementos inapropiados que no deberían tener acceso para visualización. • http://www.ibm.com/support/docview.wss?uid=swg21996255 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-9977
https://notcve.org/view.php?id=CVE-2016-9977
07 Jun 2017 — IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253. Maximo Asset Management versiones 7.1, 7.5 y 7.6 de IBM, podría permitir a un atacante remoto secuestrar la sesión de usuario, causado por un fallo para invalidar un identificador de sesión existente. Un atacante podría explotar ... • http://www.ibm.com/support/docview.wss?uid=swg22003981 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1292
https://notcve.org/view.php?id=CVE-2017-1292
26 May 2017 — IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153. Las versiones 7.5 y 7.6 de IBM Maximo Asset Management generan mensajes de error que podrían revelar información sensible para futuros ataques contra el sistema. IBM X-Force ID: 125153. • http://www.ibm.com/support/docview.wss?uid=swg22003414 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1291
https://notcve.org/view.php?id=CVE-2017-1291
26 May 2017 — IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 125152. Maximo Asset Management versiones 7.5 y 7.6 de IBM, es vulnerable a ataques de división de res... • http://www.ibm.com/support/docview.wss?uid=swg22003413 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 2%CPEs: 5EXPL: 0CVE-2016-9976
https://notcve.org/view.php?id=CVE-2016-9976
03 May 2017 — IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252. IBM Maximo Asset Management 7.1, 7.5, y 7.6 podría permitir a un atacante remoto incluir ficheros arbitrarios. Un atacante remoto podría enviar peticiones URL especialmente diseñadas para ejecutar código abritrario en el servidor afectado.... • http://www.ibm.com/support/docview.wss?uid=swg22002018 • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8924
https://notcve.org/view.php?id=CVE-2016-8924
26 Apr 2017 — IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podrían permitir a un atacante remoto secuestrar la sesión de un usuario debido a un error de validación del identificador de sesión. • http://www.ibm.com/support/docview.wss?uid=swg21996256 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.9EPSS: 0%CPEs: 32EXPL: 0CVE-2017-1124
https://notcve.org/view.php?id=CVE-2017-1124
07 Mar 2017 — IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podría permitir a un atacante local obtener información sensible utilizando inyección de encabezado HTTP. Referencia de IBM #: 1998053. • http://www.ibm.com/support/docview.wss?uid=swg21998053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0CVE-2016-5902
https://notcve.org/view.php?id=CVE-2016-5902
08 Feb 2017 — IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Maximo Asset Management es vulnerable a XSS. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la interfaz Web alterando así la funcionalidad intencionada conduciendo potencialmente a la divulgación de credenciales e... • http://www.ibm.com/support/docview.wss?uid=swg21988252 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 15EXPL: 0CVE-2016-5905
https://notcve.org/view.php?id=CVE-2016-5905
30 Nov 2016 — Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en IBM Maximo Asset Management 7.5 en versiones anteriores a 7.5.0.10 IF3 y 7.6 en versiones anteriores a 7.6.0.5 IF2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21988253 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •