3562 matches found
CVE-2011-4816: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and...
CVE-2011-1394: Undefined Security Weakness
IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database CCMDB 6.2, 7.1, and 7.2 all...
CVE-2011-4817: Exposure of Sensitive Information to an Unauthorized Actor
The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management...
CVE-2011-1396: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component...
CVE-2011-4819: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to 1 maximo.jsp or 2 the default URI under ui/...
CVE-2011-4818: Improper Input Validation
Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter to an unspecified component...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...
CVE-2008-3161
Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...
CVE-2008-3161
Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...
CVE-2008-3161
CVE-2008-3161 describes cross-site scripting (XSS) in IBM Maximo (jsp/common/system/debug.jsp) affecting Maximo versions 4.1 and 5.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML by sending crafted HTTP headers (Accept, Accept-Language, UA-CPU, Accept-Encoding,...
CVE-2008-3161: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Accept, 2 Accept-Language, 3 UA-CPU, 4 Accept-Encoding, 5 User-Agent, or 6 Cookie HTTP header. NOTE: the provenance of...
ibmmromaximo-xss.txt
Affected Software/Device: IBM MRO MAXIMO Tested Version: 4.1 , 5.2 Vulnerability: Cross Site Scripting & Information Disclosure Risk: Low / Medium Description: MRO Maximo is a strategic asset and service management system that runs on a number of databases including Oracle, SQL Server and IBM DB2...
IBM Maximo 4.15.2 - debug.jsp HTML Injection Information Disclosure
IBM Maximo 4.15.2 - debug.jsp HTML Injection Information Disclosure source: https://www.securityfocus.com/bid/30180/info IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability. An attacker may leverage these issues to obtain potentially sensitiv...
IBM Maximo 4.1/5.2 - '/debug.jsp' HTML Injection / Information Disclosure
source: https://www.securityfocus.com/bid/30180/info IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of...
CVE-2007-5949
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
Cross site scripting
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
CVE-2007-5949
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
CVE-2007-5949
CVE-2007-5949 describes a cross-site scripting (XSS) vulnerability in IBM Tivoli Service Desk 6.2. The issue allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action. Administrative or user impact is limited to the authentica...
CVE-2007-5949: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action...
CVE-2005-1601
CVE-2005-1601 affects MRO Maximo Self Service 4 and 5, where certain information is stored under the web document root and exposed via file extensions not processed by Tomcat. This allows remote attackers to directly request files (e.g., MXServer.properties) and obtain sensitive information. The ...