CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1292
https://notcve.org/view.php?id=CVE-2017-1292
IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153. Las versiones 7.5 y 7.6 de IBM Maximo Asset Management generan mensajes de error que podrían revelar información sensible para futuros ataques contra el sistema. IBM X-Force ID: 125153. • http://www.ibm.com/support/docview.wss?uid=swg22003414 https://exchange.xforce.ibmcloud.com/vulnerabilities/125153 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.4EPSS: 1%CPEs: 5EXPL: 0CVE-2016-9976
https://notcve.org/view.php?id=CVE-2016-9976
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252. IBM Maximo Asset Management 7.1, 7.5, y 7.6 podría permitir a un atacante remoto incluir ficheros arbitrarios. Un atacante remoto podría enviar peticiones URL especialmente diseñadas para ejecutar código abritrario en el servidor afectado. • http://www.ibm.com/support/docview.wss?uid=swg22002018 http://www.securityfocus.com/bid/98305 • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8924
https://notcve.org/view.php?id=CVE-2016-8924
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podrían permitir a un atacante remoto secuestrar la sesión de un usuario debido a un error de validación del identificador de sesión. • http://www.ibm.com/support/docview.wss?uid=swg21996256 http://www.securityfocus.com/bid/98023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.9EPSS: 0%CPEs: 32EXPL: 0CVE-2017-1124
https://notcve.org/view.php?id=CVE-2017-1124
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053. IBM Maximo Asset Management 7.1, 7.5 y 7.6 podría permitir a un atacante local obtener información sensible utilizando inyección de encabezado HTTP. Referencia de IBM #: 1998053. • http://www.ibm.com/support/docview.wss?uid=swg21998053 http://www.securityfocus.com/bid/96536 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0CVE-2016-5902
https://notcve.org/view.php?id=CVE-2016-5902
IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Maximo Asset Management es vulnerable a XSS. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la interfaz Web alterando así la funcionalidad intencionada conduciendo potencialmente a la divulgación de credenciales en una sesión de confianza. • http://www.ibm.com/support/docview.wss?uid=swg21988252 http://www.securityfocus.com/bid/92535 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •