The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management lies in the insufficient verification of incoming requests, allowing a hacker to execute an SSRF attack.

The vulnerability of the IBM Maximo Asset Management software system for managing corporate assets is related to insufficient verification of incoming requests. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute an SSRF attack...

Applied ThreadFix: Seeding Your Application Portfolio with OWASP Amass

OWASP Amass is a great tool for asset discovery and enterprise attack surface mapping. It pulls data from a number of different data sources and identifies potential hosts and applications associated with organizations, domains, IP CIDRs and other identifiers. As we have noted, having a solid...

Security Bulletin: Security vulnerabilities are identified in WebSphere Application Server where Rational Asset Manager is deployed

Summary In the WebSphere Application Server WAS admin console where the Rational Asset Manager RAM is deployed, security vulnerabilites are observed. Information about these security vulnerabilities affecting WebSphere Application Server are published in the respective security bulletins...

Security Bulletin: IBM Maximo Asset Management is vulnerable to path traversal (CVE-2019-4582)

Summary IBM Maximo Asset Management is vulnerable to path traversal. Vulnerability Details CVEID: CVE-2019-4582 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4643)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Exploit for Improper Access Control in Elasticsearch

欢迎各位大佬提BUG,当前版本 AssetScanV1.3 周期 初版：2019年11月28日 V1.0初版编写完成 修改1：2019年12月02日 感谢Shadow·J反馈kali下文件导入异常 修改2：2019年12月03日 V1.1发布，新增ARP存活检测（回滚，测bug） 修改3：2019年12月04日 V1.2发布，修复漏洞脚本异常，修复weblogic脚本 修改4：2019年12月05日 V1.2修改，感谢sevck提供设计思路以及代码不规范问题 修改5：2019年12月05日 V1.2修改，修复IP数据处理异常 修改6：2019年12月19日...

IBM Maximo Asset Management Cross-Site Request Forgery Vulnerability (CNVD-2021-01278)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. IBM Maximo Asset Management suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, bait a request, and can be...

Applied ThreadFix: Application Portfolio Tracking

Asset management is a serious issue across the information security space. A very common challenge we see for organizations running an application security program is just getting an idea of what applications they have available and what infrastructure has been deployed to support them. You cant...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4575)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

IBM Maximo Asset Management Reverse Label Hijacking Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A reverse tag...

CVE-2020-4409

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would...

CVE-2020-4409

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would...

Design/Logic Flaw

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would...

CVE-2020-4409

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would...

CVE-2020-4409

The CVE-2020-4409 issue affects IBM Maximo Asset Management core product versions 7.6.0 and 7.6.1, where a remote attacker could conduct phishing via a tabnabbing attack by steering a user to a crafted site and then redirecting to a trusted-appearing malicious page. Root cause is a reverse tabnab...

Security Bulletin: A security vulnerability has been identified in IBM SDK, Java Technology shipped with IBM Maximo Asset Management (CVE-2020-2601)

Summary CVE-2020-2601 was disclosed as part of the January 2020 Critical Patch Update. Java is used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4578)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

IBM Maximo Asset Management Cross-Site Request Forgery Vulnerability (CNVD-2020-52459)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. IBM Maximo Asse...

IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2020-52460)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. IBM Maximo Asse...

IBM Maximo Asset Management Code Execution Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A code executio...