CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1699
https://notcve.org/view.php?id=CVE-2018-1699
24 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145968. IBM Maximo Asset Management desde la versión 7.6 hasta la 7.6.3 es vulnerable a inyección SQL. Un atacante remoto podría enviar instrucciones SQL especialmente manipuladas que podrían permitirle visualizar, añadir, modificar o borrar información e... • http://www.securityfocus.com/bid/105189 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1715
https://notcve.org/view.php?id=CVE-2018-1715
16 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147003. IBM Maximo Asset Management desde la versión 7.6 hasta la 7.6.3 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de u... • https://exchange.xforce.ibmcloud.com/vulnerabilities/147003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2018-1528
https://notcve.org/view.php?id=CVE-2018-1528
06 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. IBM X-Force ID: 142290. IBM Maximo Asset Management, desde la versión 7.6 hasta la 7.6.3, podría permitir que un usuario autenticado obtenga información sensible desde la API WhoAmI. IBM X-Force ID: 142290. • http://www.securityfocus.com/bid/105023 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 19EXPL: 0CVE-2018-1524
https://notcve.org/view.php?id=CVE-2018-1524
03 Aug 2018 — IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to the system. This vulnerability is due to an incomplete fix for CVE-2015-4966. IBM X-Force ID: 142116. IBM Maximo Asset Management, de la versión 7.6 a la 7.6.3, se instala con una cuenta de administrador por defecto que podría ser empleada por un atacante remoto para obtener acceso de administrador al sistema. Esta vulnerabilidad existe debido a una sol... • https://exchange.xforce.ibmcloud.com/vulnerabilities/142116 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1554
https://notcve.org/view.php?id=CVE-2018-1554
02 Aug 2018 — IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142891. IBM Maximo Asset Management 7.6 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previs... • http://www.securityfocus.com/bid/104959 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2017-1357
https://notcve.org/view.php?id=CVE-2017-1357
09 Aug 2017 — IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684. IBM Maximo Asset Management 7.5 y 7.6 podría permitir que un usuario autenticado manipulase órdenes de trabajo para falsificar correos electrónicos. Esto podría emplearse para llevar a cabo ataques más avanzados. IBM X-Force ID: 126684. • http://www.ibm.com/support/docview.wss?uid=swg22006647 • CWE-20: Improper Input Validation •
CVSS: 2.9EPSS: 0%CPEs: 32EXPL: 0CVE-2017-1124
https://notcve.org/view.php?id=CVE-2017-1124
07 Mar 2017 — IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podría permitir a un atacante local obtener información sensible utilizando inyección de encabezado HTTP. Referencia de IBM #: 1998053. • http://www.ibm.com/support/docview.wss?uid=swg21998053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 15EXPL: 0CVE-2016-5905
https://notcve.org/view.php?id=CVE-2016-5905
30 Nov 2016 — Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en IBM Maximo Asset Management 7.5 en versiones anteriores a 7.5.0.10 IF3 y 7.6 en versiones anteriores a 7.6.0.5 IF2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21988253 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 31EXPL: 0CVE-2016-5987
https://notcve.org/view.php?id=CVE-2016-5987
30 Nov 2016 — IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sensitive information via a crafted HTTP request that triggers construction of a runtime error message. IBM Maximo Asset Management 7.1 hasta la versión 7.1.1.13, 7.5 en versiones anteriores a 7.5.0.10 IF4 y 7.6 en versiones anteriores a 7.6.0.5 IF3 permite a atacantes remotos obtener información sensible a través de una petición HTTP manipulada que desencadena las construc... • http://www-01.ibm.com/support/docview.wss?uid=swg21990449 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 0CVE-2016-0393
https://notcve.org/view.php?id=CVE-2016-0393
17 Jul 2016 — IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL information by reading log files. IBM Maximo Asset Management 7.5 en versiones anteriores a 7.5.0.10-TIV-MBS-IFIX002 y 7.6 en versiones anteriores a 7.6.0.5-TIV-MAMMT-FP001 permite a atacantes remotos obtener información sensible de URL leyendo archivos de registro. • http://www-01.ibm.com/support/docview.wss?uid=swg21986053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •