Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier (CVE-2016-9977)

Summary IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. Vulnerability Details CVEID: CVE-2016-9977...

Security Bulletin: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks (CVE-2017-1291)

Summary IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. Vulnerability Details CVEID: CVE-2017-1291 DESCRIPTION: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted UR...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to hijack a user's session (CVE-2016-9977)

Summary IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session.. Vulnerability Details CVEID: CVE-2016-9977...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to include arbitrary files (CVE-2016-9976)

Summary IBM Maximo Asset Management could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. Vulnerability Details CVEID: CVE-2016-9976 DESCRIPTION: IB...

Security Bulletin: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator (CVE-2016-9984)

Summary IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. Vulnerability Details CVEID: CVE-2016-9984 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary comman...

Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection (CVE-2017-1124)

Summary IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection. Vulnerability Details CVEID: CVE-2017-1124 DESCRIPTION: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injectio...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier (CVE-2016-8924)

Summary IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. Vulnerability Details CVEID: CVE-2016-8924...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to view incorrect item sets that they should not have access to view (CVE-2016-8987)

Summary IBM Maximo Asset Management could allow an authenticated user to view incorrect item sets that they should not have access to view. Vulnerability Details CVEID: CVE-2016-8987 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to view incorrect item sets that they...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-9736)

Summary IBM WebSphere Application Server is shipped with Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2016-6072)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Asset and Service Management

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 7, and 8 that are used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions including Maximo for Aviation, Maximo for...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0359)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2015-0254)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0306)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to select items within the system that they should not have permission to do so (CVE-2016-0289)

Summary IBM Maximo Asset Management could allow an authenticated user to select items within the system that they should not have permission to do so. Vulnerability Details CVEID: CVE-2016-0289 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to select items within the...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0262)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to view work logs during purchase orders that they should not have access to (CVE-2016-0222)

Summary IBM Maximo Asset Management could allow an authenticated user to view work logs during purchase orders that they should not have access to. Vulnerability Details CVEID: CVE-2016-0222 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to view work logs during purcha...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0475, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: Multiple vulnerabilities identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0201, CVE-2015-7420)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...