PT-2012-1965

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description The issue allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter ...

PT-2012-1966

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description The issue allows remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to specific endpoints, including 1...

PT-2012-2393

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 6.2, 7.1, 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, 7.2 IBM Tivoli Service Request Manager versions 7.1, 7.2 IBM Maximo Service Desk version 6.2 IBM Tivoli Change and Configuration Managemen...

PT-2012-1519

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 IBM Tivoli Asset Management for IT versions 6.2, 7.1, and 7.2 IBM Tivoli Service Request Manager versions 7.1 and 7.2 IBM Maximo Service Desk version 6.2 IB...

CVE-2011-1397: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM...

PT-2012-1520

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the controlid parameter in the...

PT-2012-1521

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management and Asset Management Essentials versions 6.2, 7.1, and 7.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...

CVE-2008-3161

Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...

CVE-2008-3161

Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...

CVE-2008-3161

CVE-2008-3161 describes cross-site scripting (XSS) in IBM Maximo (jsp/common/system/debug.jsp) affecting Maximo versions 4.1 and 5.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML by sending crafted HTTP headers (Accept, Accept-Language, UA-CPU, Accept-Encoding,...

CVE-2008-3161: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...

IBM Maximo 4.15.2 - debug.jsp HTML Injection Information Disclosure

IBM Maximo 4.15.2 - debug.jsp HTML Injection Information Disclosure source: https://www.securityfocus.com/bid/30180/info IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability. An attacker may leverage these issues to obtain potentially sensitiv...

ibmmromaximo-xss.txt

Affected Software/Device: IBM MRO MAXIMO Tested Version: 4.1 , 5.2 Vulnerability: Cross Site Scripting & Information Disclosure Risk: Low / Medium Description: MRO Maximo is a strategic asset and service management system that runs on a number of databases including Oracle, SQL Server and IBM DB2...

IBM Maximo 4.1/5.2 - '/debug.jsp' HTML Injection / Information Disclosure

source: https://www.securityfocus.com/bid/30180/info IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...

CVE-2007-5949

Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...

CVE-2007-5949

Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...

CVE-2007-5949

CVE-2007-5949 describes a cross-site scripting (XSS) vulnerability in IBM Tivoli Service Desk 6.2. The issue allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action. Administrative or user impact is limited to the authentica...

CVE-2007-5949: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...