CVSS: 8.2EPSS: 0%CPEs: 42EXPL: 0CVE-2020-4409
https://notcve.org/view.php?id=CVE-2020-4409
16 Sep 2020 — IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537. IBM Maximo Asset Management versiones 7.6.0 y 7.6.1, ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/179537 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 40EXPL: 0CVE-2013-3323
https://notcve.org/view.php?id=CVE-2013-3323
18 Feb 2020 — A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalidate the authentication session, which could let a malicious user obtain unauthorized access. Se presenta una vulnerabilidad de escalada de privilegios en IBM Maximo Asset Management versiones 7.5, 7.1 y 6.2, cuando WebSeal con Autenticación Básica es usado, debido a un fallo al invalidar la sesión de autenticación, lo que podría permitir a u... • http://www.securityfocus.com/bid/62685 • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 45EXPL: 0CVE-2014-3084
https://notcve.org/view.php?id=CVE-2014-3084
29 Aug 2014 — IBM Maximo Asset Management 6.1 through 6.5, 7.1 through 7.1.1.13, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2.8, 7.1, and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended write-access restrictions on calendar entries via unspecified vectors. IBM Maximo Asset Management 6.1 hasta 6.5, 7.1 hasta 7.1.1.13, y 7.5 hasta 7.5.0.6;... • http://secunia.com/advisories/60408 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 99EXPL: 0CVE-2014-0915
https://notcve.org/view.php?id=CVE-2014-0915
30 Jul 2014 — Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via (1) the KPI display name field or (2) a por... • http://secunia.com/advisories/59570 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 99EXPL: 0CVE-2014-0914
https://notcve.org/view.php?id=CVE-2014-0914
30 Jul 2014 — Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management for IT and Maximo Service Desk allows remote authenticated users to inject arbitrary web script or HTML via the Query Description Field. Vulnerabilidad de XSS en IBM Maximo Asset Management 6.2 hasta 6.2.8 y 6.x y... • http://secunia.com/advisories/59570 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 99EXPL: 0CVE-2014-3025
https://notcve.org/view.php?id=CVE-2014-3025
30 Jul 2014 — Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via unspecified input to a .jsp file under webc... • http://secunia.com/advisories/59570 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 26EXPL: 0CVE-2013-4014
https://notcve.org/view.php?id=CVE-2013-4014
01 Oct 2013 — Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en IBM Maximo Asset Management 6.2 hasta la versión 6.2.8, 7.1 anterior a 7.1.1.12, y 7.5 anterior a la versión 7.5.0.5 permite a atacantes remotos inyectar script web arbitrario o HTML a través de vectores sin especificar. • http://secunia.com/advisories/55068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 26EXPL: 0CVE-2013-5380
https://notcve.org/view.php?id=CVE-2013-5380
01 Oct 2013 — IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows local users to obtain sensitive information via unspecified vectors. IBM Maximo Asset Management 6.2 hasta la versión 6.2.8, 7.1 anterior a 7.1.1.12, y 7.5 anterior a la versión 7.5.0.5 permite a usuarios locales obtener información sensible a través de vectores sin especificar. • http://secunia.com/advisories/55068 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.0EPSS: 0%CPEs: 25EXPL: 0CVE-2013-4018
https://notcve.org/view.php?id=CVE-2013-4018
01 Oct 2013 — IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via unspecified vectors. IBM Maximo Asset Management 6.2 hasta la versión 6.2.8, 7.1 anterior a 7.1.1.12, y 7.5 anterior a la versión 7.5.0.5 permite a usuarios remotos autenticados obtener información sensible a través de vectores sin especificar. • http://secunia.com/advisories/55068 •
CVSS: 5.4EPSS: 0%CPEs: 23EXPL: 0CVE-2013-3048
https://notcve.org/view.php?id=CVE-2013-3048
01 Oct 2013 — Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en IBM Maximo Asset Management 6.2 hasta la versión 6.2.8, 7.1 hasta 7.1.1.12, y 7.5 anterior a la versión 7.5.0.3 permite a usuarios remotos autenticados inyectar script web o HTML arbitrario a través de vectores sin especificar. • http://secunia.com/advisories/55068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •