IBM Maximo Asset Management Cross-Site Scripting Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution. A cross-site scripting vulnerability exists in IBM Maximo Asset Management, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

CVE-2011-4346

Cross-site scripting XSS vulnerability in the web interface in Red Hat Network RHN Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page...

ResourceSpace CMS 7.3.7009 SQL Injection Vulnerability

ResourceSpace CMS versions 7.3.7009 and below suffer from a remote SQL injection vulnerability. Title: Blind boolean sql injection vulnerability in ResourceSpace CMS Author: William F. Reyor III Contact: email protected Published: August 22 2015 Vendor: Montala Limited Vendor url:...

Cross-Site Request Forgery Vulnerability in Multiple EMC Documentum Products

EMC Documentum WebTop is a suite of products that allow users to access Documentum repositories and content management services in a standard browser application.Documentum Administrator is a Web-based development tool used to perform Documentum system management tasks. Documentum Administrator i...

Sql injection

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy...

CVE-2015-4426

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy...

CVE-2015-4425

CVE-2015-4425 affects Pimcore CMS. A directory traversal vulnerability exists in Pimcore builds prior to 3473 where an administrative user with the assets permission can overwrite arbitrary files by supplying a ../ path in the dir parameter to /admin/asset/add-asset-compatibility. Public writeups...

CVE-2015-4425

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

PT-2015-6586

Name of the Vulnerable Software and Affected Versions pimcore versions prior to build 3473 Description The issue allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to "admin/asset/add-asset-compatibility"...

PT-2015-6587

Name of the Vulnerable Software and Affected Versions pimcore versions prior to build 3473 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the filter parameter to the "admin/asset/grid-proxy" API endpoint. Recommendations For versions prior to...

CVE-2015-4426: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy...

CVE-2015-4425: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

CVE-2015-5766

Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling...

CVE-2015-5766

CVE-2015-5766 concerns Apple iOS prior to 8.4.1, where a directory traversal issue in the Air Traffic component allowed access to arbitrary filesystem locations via vectors related to asset handling. The root cause is a path/asset handling validation weakness within Air Traffic, enabling potentia...

CVE-2015-5766: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling...

SQL Injection Vulnerability in the ClassID Parameter of Guozidian's Asset Management Information System for Administrative Utilities

The Administrative Utility Asset Management Information System is an asset management information system, in order to standardize and strengthen the management of state-owned asset management information system of administrative institutions, and to improve the level of informationization of...

IBM Maximo Asset Management Information Disclosure Vulnerability (CNVD-2015-04186)

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. An information disclosure vulnerability exists in IBM Maximo Asset Management, which allows local attackers to exploit the vulnerability to obtain sensitive information...

CVE-2015-1951

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

Design/Logic Flaw

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

CVE-2015-1951

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...