CVE-2013-4016

CVE-2013-4016 describes an SQL injection vulnerability in IBM Maximo family (Asset Management, SmartCloud Control Desk, Tivoli components) where a Birt report with a plain-text WHERE clause enables remote authenticated users to run arbitrary SQL. IBM’s bulletin lists multiple fixes per product/ve...

CVE-2013-5460

CVE-2013-5460 affects IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2. The issue allows remote authenticated users to bypass intended access restrictions and read communication logs of unrelated records via unspecified vecto...

CVE-2013-5464

CVE-2013-5464 affects IBM Maximo Asset Management 7.5.x (various subversions) and SmartCloud Control Desk 7.x. The issue allows remote authenticated users to bypass access restrictions and modify physical counts in restricted storerooms via unspecified vectors. IBM references APARs IV46277, IV465...

CVE-2013-5465

CVE-2013-5465 concerns IBM Maximo and related Tivoli/SmartCloud products where uploads permit invalid file types due to inadequate input validation. The issue affects multiple versions across Maximo Asset Management (7.5, 7.1, 6.2), Maximo Asset Management Essentials, Maximo variants for Governme...

CVE-2013-6741

The CVE-2013-6741 issue affects IBM Maximo Asset Management and related IBM Tivoli products, allowing remote authenticated users to obtain potentially sensitive stack-trace information by triggering a Birt error. Affected products include Maximo Asset Management 7.x (before 7.1.1.7 LAFIX.20140319...

CVE-2014-0825

The CVE-2014-0825 entry describes an XSS vulnerability in openreport.jsp affecting IBM Maximo Asset Management 7.x (including 7.1, 7.5 ranges) and related Tivoli/SmartCloud components, where remote authenticated users can inject arbitrary web script or HTML via a crafted report parameter. The IBM...

CVE-2014-0849

CVE-2014-0849 affects IBM Maximo Asset Management and SmartCloud Control Desk (and related Tivoli MAXIMO/Tivoli products) where remote authenticated users can gain privileges by leveraging membership in two security groups. The issue is described as a privilege-escalation related to security grou...

CVE-2014-0893

The CVE-2014-0893 entry describes a Cross-Site Scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5.x (before 7.5.0.5 IFIX006) and SmartCloud Control Desk 7.x (before 7.5.0.3 and 7.5.1.x before 7.5.1.2) where remote authenticated users can inject arbitrary web script or HTML via unspe...

CVE-2013-2998

frontcontroller.jsp in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to obtain sensitive information via an invalid actioncode...

CVE-2012-3333

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

Code injection

frontcontroller.jsp in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to obtain sensitive information via an invalid actioncode...

Crlf injection

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

CVE-2013-2998

frontcontroller.jsp in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote authenticated users to obtain sensitive information via an invalid actioncode...

CVE-2012-3333

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

CVE-2012-3333

CVE-2012-3333 affects IBM Maximo Asset Management and SmartCloud Control Desk via a CRLF injection that allows HTTP header manipulation and HTTP response splitting through crafted URL parameters. Affected products include Maximo Asset Management and related variants across 7.5/7.1/6.2 lines and S...

CVE-2013-2998

CVE-2013-2998 affects IBM Maximo Asset Management and SmartCloud Control Desk. Vulnerability: information disclosure via frontcontroller.jsp when processing an invalid action_code, allowing remote authenticated users to obtain sensitive information. Affected products/versions include Maximo Asset...

PT-2014-2644

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.0.0 through 7.5.0.5 IBM SmartCloud Control Desk versions 7.0.0 through 7.5.0.2 IBM SmartCloud Control Desk versions 7.5.1.0 through 7.5.1.1 Description The issue allows remote authenticated users to obtai...

PT-2014-2932

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5.x before 7.5.0.3 IFIX027 IBM Maximo Asset Management version 7.5.0.4 before IFIX011 IBM Maximo Asset Management version 7.5.0.5 before IFIX006 SmartCloud Control Desk versions 7.x before 7.5.0.3...

PT-2014-2931

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.0.0 through 7.5.0.5 IBM SmartCloud Control Desk versions 7.0.0 through 7.5.0.2 IBM SmartCloud Control Desk versions 7.5.1.0 through 7.5.1.1 Description The issue allows remote authenticated users to bypas...

PT-2014-2933

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1.1.7 before LAFIX.20140319-0837 IBM Maximo Asset Management versions 7.1.1.11 before IFIX.20140323-0749 IBM Maximo Asset Management versions 7.1.1.12 before IFIX.20140321-1336 IBM Maximo Asset Management...