Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks (CVE-2017-1357)

Summary IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. Vulnerability Details CVEID: CVE-2017-1357 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection(CVE-2017-1175)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1175 DESCRIPTION: IBM Maximo...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier (CVE-2016-9977)

Summary IBM Maximo Asset Management could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. Vulnerability Details CVEID: CVE-2016-9977...

Security Bulletin: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks (CVE-2017-1291)

Summary IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. Vulnerability Details CVEID: CVE-2017-1291 DESCRIPTION: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted UR...

Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection (CVE-2017-1124)

Summary IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection. Vulnerability Details CVEID: CVE-2017-1124 DESCRIPTION: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injectio...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-9736)

Summary IBM WebSphere Application Server is shipped with Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2016-6072)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Asset and Service Management

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 7, and 8 that are used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions including Maximo for Aviation, Maximo for...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0359)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2015-0254)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0306)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0262)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0475, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: Multiple vulnerabilities identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0201, CVE-2015-7420)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...

Security Bulletin: A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API (CVE-2015-7452)

Summary A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API. Vulnerability Details CVEID: CVE-2015-7452 DESCRIPTION: A security vulnerability has been identified in IBM Maximo Asset Management which...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to change or view information that the user should not have access to due to issues with the Scheduler functionality (CVE-2015-7396)

Summary IBM Maximo Asset Management could allow an authenticated user to change or view information that the user should not have access to due to issues with the Scheduler functionality. This vulnerability could allow a local attacker to compromise data integrity and confidentiality. The...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to view query results that the user should not have access to view due to improper access control (CVE-2015-5051)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated user to view query results that the user should not have access to view due to improper access control. This vulnerability could allow a local attacker to compromise data integrity. The vulnerability...

Security Bulletin: Security Vulnerability in IBM Maximo Asset Management (CVE-2015-1951) allows cacheable HTTPS response

Summary A vulnerability in Maximo Asset Management could allow an attacker to obtain sensitive information which is stored in a local cache. The vulnerability affects Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization,...

Security Bulletin: GSKit TLS Padding Vulnerability affects IBM Tivoli/Security Server on Asset and Service Management (CVE-2014-8730)

Summary IBM Tivoli/Security Directory Server ITDS/ISDS are affected by a TLS padding vulnerability, which could allow a remote attacker to obtain sensitive information. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: IBM Security Directory Server could allow a remote attacker to obtain...