PT-2012-1522

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2 through 7.5 IBM Asset Management Essentials versions 6.2 through 7.5 IBM Tivoli Asset Management for IT versions 6.2 through 7.2 IBM Tivoli Service Request Manager versions 7.1 through 7.2 IBM Maximo...

PT-2012-2393

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2, 7.1, 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, 7.2 IBM Tivoli Service Request Manager versions 7.1, 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuration Managemen...

CVE-2011-4817: Exposure of Sensitive Information to an Unauthorized Actor

The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management...

CVE-2011-1397: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM...

CVE-2011-4816: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and...

CVE-2011-1394: Undefined Security Weakness

IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database CCMDB 6.2, 7.1, and 7.2 all...

CVE-2012-0195: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service...

PT-2012-1963

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2, 7.1, 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, 7.2 IBM Tivoli Service Request Manager versions 7.1, 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuration Managemen...

PT-2012-1519

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, and 7.2 IBM Tivoli Service Request Manager versions 7.1 and 7.2 IBM Maximo Service Desk version 6.2 IB...

PT-2012-1964

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2 through 7.5 IBM Tivoli Asset Management for IT versions 6.2 through 7.2 IBM Tivoli Service Request Manager versions 7.1 through 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuratio...

Cisco Unity Connection 7.1远程权限提升漏洞

BUGTRAQ ID: 52216 CVE ID: CVE-2012-0366 Cisco Unity Connection是运行在Linux-based Cisco Unified Communications操作系统上的功能强大的语音消息通讯平台。 Cisco Unity Connection在验证"Help Desk Administrator"和分配权限时在实现上存在安全漏洞，攻击者可利用此漏洞获取完全控制权限 0 Cisco Unity Connection 7.1 厂商补丁： Cisco -----...

CVE-2012-0366

Cisco Unity Connection before 7.1.3bSu2 allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141...

CVE-2012-0366

Cisco Unity Connection (Linux-based platform) prior to versions 7.1.3b(Su2) and 7.1.5 is affected by CVE-2012-0366, a privilege-escalation vulnerability where an authenticated user with the Help Desk Administrator role can change the administrative password, gaining full control. The issue stems ...

PT-2012-2525

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection versions prior to 7.1.3bSu2 Description The issue allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role. Recommendations For versions prior to 7.1.3bSu2,...

CVE-2012-0366: Undefined Security Weakness

Cisco Unity Connection before 7.1.3bSu2 allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141...

Support Incident Tracker multiple vulnerabilities

Overview Support Incident Tracker or SiT! version 3.65, and possibly earlier versions, contain multiple vulnerabilities including; malicious file uploads, SQL injection, cross-site scripting, and cross-site request forgery. Description According to the SiT! website:"Support Incident Tracker or Si...

Lax Security to Blame for NASDAQ Hack

The cyber attack on the NASDAQ OMX Group late last year was the result of shoddy security, according to a new report via Reuters. Computers running NASDAQ’s Director’s Desk, the software that was breached, had faulty firewalls, missing security patches and were running outdated software, like...

OneOrZero AIMS authentication bypass and SQLi vulnerabilities

Overview OneOrZero Action & Information Management System AIMS is vulnerable to an authentication bypass and SQL injection. Description According to the vendor's website:"OneOrZero AIMS is a powerful enterprise ready suite that includes a help desk, knowledge base, time manager and reporting syst...

Multiple vulnerabilities in Help Desk Software

Vulnerability ID: HTB23041 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinhelpdesksoftware.html Product: Help Desk Software Vendor: freehelpdesk.org http://freehelpdesk.org/ Vulnerable Version: 1.1b and probably prior Tested Version: 1.1b Vendor Notification: 17 August 2011...

Help Desk Software 1.1b XSS / XSRF / SQL Injection

Vulnerability ID: HTB23041 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinhelpdesksoftware.html Product: Help Desk Software Vendor: freehelpdesk.org http://freehelpdesk.org/ Vulnerable Version: 1.1b and probably prior Tested Version: 1.1b Vendor Notification: 17 August 2011...