PT-2012-1522

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2 through 7.5 IBM Asset Management Essentials versions 6.2 through 7.5 IBM Tivoli Asset Management for IT versions 6.2 through 7.2 IBM Tivoli Service Request Manager versions 7.1 through 7.2 IBM Maximo...

PT-2012-1521

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified...

PT-2012-2393

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2, 7.1, 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, 7.2 IBM Tivoli Service Request Manager versions 7.1, 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuration Managemen...

CVE-2011-4817: Exposure of Sensitive Information to an Unauthorized Actor

The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management...

CVE-2012-0195: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service...

CVE-2011-1395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter...

CVE-2011-1397: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM...

CVE-2011-1396: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component...

CVE-2011-4819: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to 1 maximo.jsp or 2 the default URI under ui/...

PT-2012-1520

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the controlid parameter in the...

PT-2012-1966

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description The issue allows remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to specific endpoints, including 1...

CVE-2011-1394: Undefined Security Weakness

IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database CCMDB 6.2, 7.1, and 7.2 all...

CVE-2011-4816: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and...

PT-2012-1963

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2, 7.1, 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, 7.2 IBM Tivoli Service Request Manager versions 7.1, 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuration Managemen...

CVE-2011-4818: Improper Input Validation

Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter to an unspecified component...

PT-2012-1965

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description The issue allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter ...

PT-2012-1519

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, and 7.2 IBM Tivoli Service Request Manager versions 7.1 and 7.2 IBM Maximo Service Desk version 6.2 IB...

PT-2012-1964

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2 through 7.5 IBM Tivoli Asset Management for IT versions 6.2 through 7.2 IBM Tivoli Service Request Manager versions 7.1 through 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuratio...

Stack overflow

Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file...

CVE-2012-0198: Undefined Security Weakness

Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file...