CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2019-4512
https://notcve.org/view.php?id=CVE-2019-4512
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554. IBM Maximo Asset Management versión 7.6.1.1, genera un mensaje de error que incluye información confidencial que podría ser usada en futuros ataques contra el sistema. ID de IBM X-Force: 164554. • https://exchange.xforce.ibmcloud.com/vulnerabilities/164554 https://www.ibm.com/support/pages/node/1075413 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.5EPSS: 0%CPEs: 20EXPL: 0CVE-2019-4364
https://notcve.org/view.php?id=CVE-2019-4364
IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680. IBM Maximo Asset Management versión 7.6 es vulnerable a la inyección de CSV, lo que podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema. ID de IBM X-Force: 161680. • http://www.securityfocus.com/bid/108910 https://exchange.xforce.ibmcloud.com/vulnerabilities/161680 https://www.ibm.com/support/docview.wss?uid=ibm10887557 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 5.4EPSS: 0%CPEs: 20EXPL: 0CVE-2019-4303
https://notcve.org/view.php?id=CVE-2019-4303
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949. IBM Maximo Asset Management versión 7.6 es vulnerable a cross-site-scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conllevar a la divulgación de credenciales dentro de una sesión de confianza. • http://www.securityfocus.com/bid/108912 https://exchange.xforce.ibmcloud.com/vulnerabilities/160949 https://www.ibm.com/support/docview.wss?uid=ibm10887563 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2019-4056
https://notcve.org/view.php?id=CVE-2019-4056
IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565. La aplicación Work Center de IBM Maximo Asset Management versión 7.6 no comprueba el tipo de archivo en la carga, lo que permite a los atacantes cargar archivos maliciosos. ID de IBM X-Force: 156565. • https://exchange.xforce.ibmcloud.com/vulnerabilities/156565 https://www.ibm.com/support/docview.wss?uid=ibm10880149 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 2.1EPSS: 0%CPEs: 21EXPL: 0CVE-2019-4048
https://notcve.org/view.php?id=CVE-2019-4048
IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311. IBM Maximo Asset Management versión 7.6 podría permitir a un usuario físico del sistema obtener información confidencial de un usuario anterior de la misma máquina. ID de IBM X-Force: 156311. • https://exchange.xforce.ibmcloud.com/vulnerabilities/156311 https://www.ibm.com/support/docview.wss?uid=ibm10880147 • CWE-269: Improper Privilege Management •