CVE-2015-7448

CVE-2015-7448 is a SQL injection vulnerability affecting IBM Maximo Asset Management (and related Tivoli/SmartCloud Control Desk components) where remote authenticated users can cause arbitrary SQL execution via unspecified vectors. Affected products/versions include Maximo Asset Management 7.1–7...

CVE-2015-7487

CVE-2015-7487 affects IBM Maximo Asset Management and related Tivoli products. The vulnerability allows a local attacker with administrative privileges to read log files and obtain sensitive information, due to improper handling of logs in several Maximo/Tivoli components (Maximo Asset Management...

CVE-2017-1124

CVE-2017-1124 affects IBM Maximo Asset Management core versions 7.6, 7.5 and 7.1 (and Maximo Asset Management Essentials) plus affected IBM Industry Solutions and Control Desk products when installed on a vulnerable core. Root cause: HTTP header injection enabling local information disclosure by ...

CVE-2011-4816

CVE-2011-4816 is a SQL injection vulnerability in the KPI component affecting IBM Maximo Asset Management and Asset Management Essentials (versions 6.2, 7.1, 7.5), IBM Tivoli Asset Management for IT (6.2, 7.1, 7.2), IBM Tivoli Service Request Manager (7.1, 7.2), IBM Maximo Service Desk (6.2), and...

CVE-2012-0747

CVE-2012-0747 is an SQL injection vulnerability affecting IBM Maximo Asset Management across versions 6.2 through 7.5 (and enabled in related products such as SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and CCMDB). The issue allows...

CVE-2014-0824

CVE-2014-0824 is an XSS vulnerability in IBM Maximo Asset Management 7.x (and related Tivoli/CMDB components) where remote authenticated users can inject arbitrary web script or HTML via an attachment URL. Connected IBM advisories map affected releases to specific APARs (IV52829, IV41871, IV46511...

CVE-2015-4966

CVE-2015-4966 affects IBM Maximo Asset Management core products (versions 7.1, 7.5, 7.6 and associated SmartCloud Control Desk/Tivoli IT Asset Management for IT, etc.). The flaw is a default administrator account that could allow remote authenticated users to gain administrative access via unspec...

CVE-2017-1558

The connected IBM bulletin confirms CVE-2017-1558 affects Maximo Asset Management 7.5 and 7.6 (and related products) via an open redirect that enables remote phishing by spoofing displayed URLs. Impact: user redirection to a malicious site and potential data exposure; CVSS v3.0 base score 6.1 (Ne...

CVE-2018-1715

Summary: CVE-2018-1715 affects IBM Maximo Asset Management 7.6 (up to 7.6.3). The issue is a cross-site scripting vulnerability that can allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM bulletin and NVD ...

CVE-2022-41734

CVE-2022-41734 affects IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 (and related MAS Manage components) where remote attackers can obtain sensitive information via detailed browser error messages, enabling information disclosure. The issue is a result of insufficient protection of sensitive da...

CVE-2012-0195

CVE-2012-0195 is a documented XSS vulnerability in the Start Center Layout and Configuration component across IBM Maximo Asset Management and Asset Management Essentials (6.2, 7.1, 7.5), IBM Tivoli Asset Management for IT (6.2, 7.1, 7.2), IBM Tivoli Service Request Manager (7.1, 7.2), IBM Maximo ...

CVE-2012-6356

CVE-2012-6356 affects IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5. The vulnerability allows remote authenticated users to escalate privileges via vectors related to an import operation. The available sources (NVD entry and related recor...

CVE-2014-0915

CVE-2014-0915 affects IBM Maximo and related products (Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government/Nuclear Power/Transportation/Life Sciences/Oil & Gas/Utilities, Tivoli IT, Tivoli Service Request Manager, Maximo Service Desk, CMDB, SmartCloud Control Desk) ...

CVE-2016-0289

CVE-2016-0289 affects IBM Maximo Asset Management SHIPREC (shiprec.xml) in core 7.6 and 7.5. It allows an authenticated user to bypass item-selection restrictions via the SHIPREC application. Affected versions: Maximo Asset Management 7.6 and 7.5 (and related Industry Solutions/SmartCloud Control...

CVE-2017-1208

CVE-2017-1208 affects IBM Maximo Asset Management 7.6, 7.5, and 7.1 (core product and affected related offerings). The IBM bulletin confirms a cross-site scripting vulnerability in the Web UI that lets attackers embed arbitrary JavaScript, potentially leading to credentials disclosure within a tr...

CVE-2017-1499

IBM Maximo Asset Management 7.5 and 7.6 are affected by CVE-2017-1499, where a remote attacker can include arbitrary files, potentially executing arbitrary code on the vulnerable Web server. The IBM Security Bulletin lists affected cores (Maximo Asset Management 7.6 and 7.5; Essentials 7.5) and r...

CVE-2012-3327

CVE-2012-3327 describes a cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management (versions 6.2–7.5), Maximo Asset Management Essentials (6.2–7.5), Tivoli Asset Management for IT (6.2–7.2), Tivoli Service Request Manager (7.1–7.2), Maximo Service Desk (6.2), CCMDB (7.1–7.2), and S...

CVE-2017-1175

CVE-2017-1175 affects IBM Maximo Asset Management core product: versions 7.1, 7.5, and 7.6 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The IBM security bulletin lists remediation as a...

CVE-2019-4512

CVE-2019-4512 affects IBM Maximo Asset Management 7.6.1.1. The vulnerability arises from an error message that leaks sensitive information, enabling information disclosure. The IBM Security Bulletin lists affected products (core Maximo Asset Management 7.6.1.1 and related Industry Solutions/Contr...

CVE-2021-20509

CVE-2021-20509 affects IBM Maximo Asset Management core product versions 7.6.0.x and 7.6.1.x. Root cause: improper validation of CSV file contents, enabling CSV Injection that could allow a remote attacker to execute arbitrary commands on the system. Remediation: IBM’s bulletin provides fixes (In...

CVE-2022-40616

CVE-2022-40616 affects IBM Maximo Asset Management versions 7.6.1.1, 7.6.1.2, and 7.6.1.3. The IBM bulletin describes an authentication bypass vulnerability that could allow a user to obtain sensitive information or perform tasks without authorization. Root cause: improper authentication in the M...

CVE-2023-32334

Summary. CVE-2023-32334 affects IBM Maximo Asset Management 7.6.1.2–7.6.1.3 and IBM Maximo Application Suite (MAS) 8.8.0. The root cause is storing sensitive information in URL parameters, which can disclose data if URLs are exposed in server logs, referrer headers, or browser history. Impact. In...

CVE-2011-1394

CVE-2011-1394 affects IBM Maximo/Asset Management family (6.2–7.5) and related Tivoli products (Asset Management for IT, Service Request Manager, Maximo Service Desk, CCMDB). The issue is a Denial of Service caused by memory exhaustion from establishing many UI sessions within a single HTTP sessi...

CVE-2011-1396

The CVE-2011-1396 entry describes an XSS vulnerability in IBM Maximo Asset Management and Asset Management Essentials (versions 6.2, 7.1, 7.5) that allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component. Affected products include Ma...

CVE-2011-4818

CVE-2011-4818 affects IBM Maximo Asset Management and Asset Management Essentials (versions 6.2, 7.1, 7.5). It is an open redirect via the uisessionid parameter to an unspecified component, enabling remote authenticated users to redirect to arbitrary sites (phishing risk). IBM’s vulnerability not...

CVE-2012-2183

IBM’s advisory confirms CVE-2012-2183 is a session-fixation vulnerability affecting IBM Maximo Asset Management products (7.5, 7.1, 6.2) and related offerings (SmartCloud Control Desk, Tivoli IT/Service Request Manager, Maximo Service Desk, CCMDB). The issue originates from how web sessions are e...

CVE-2012-2184

CVE-2012-2184 is a session‑fixation vulnerability in IBM Maximo Asset Management 7.1–7.5 (used in SmartCloud Control Desk, Tivoli AM for IT, SRM, Maximo Service Desk, CCMDB). The issue allows remote attackers to hijack web sessions via unspecified vectors. IBM’s bulletin lists affected releases a...

CVE-2012-2185

CVE-2012-2185 affects IBM Maximo Asset Management and related products (Maximo Asset Management 6.2–7.5 and associated suites) used with SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and CCMDB. The IBM bulletin documents information ...

CVE-2013-2998

CVE-2013-2998 affects IBM Maximo Asset Management and SmartCloud Control Desk. Vulnerability: information disclosure via frontcontroller.jsp when processing an invalid action_code, allowing remote authenticated users to obtain sensitive information. Affected products/versions include Maximo Asset...

CVE-2015-1934

CVE-2015-1934 affects IBM Maximo Asset Management and related products. The root issue is weak encryption of passwords, allowing context-dependent attackers with access to a password file to obtain cleartext passwords. Affected versions include Maximo Asset Management 7.1–7.1.1.13, 7.5.x before 7...

CVE-2015-4967

IBM Maximo Asset Management is affected by CVE-2015-4967, a SQL injection vulnerability. A remote attacker could send specially-crafted SQL statements to view, add, modify, or delete data in the back-end database. Affected products and versions include Maximo Asset Management (7.6, 7.5, 7.1), Max...

CVE-2015-5017

The CVE-2015-5017 issue affects IBM Maximo Asset Management family (including Maximo Asset Management 7.6, 7.5, 7.1; Essentials; and related products like SmartCloud Control Desk and Tivoli IT Asset Management for IT). It allows remote authenticated users to bypass access controls by signing in w...

CVE-2015-7396

CVE-2015-7396 affects IBM Maximo Asset Management (and related solutions) including Maximo Asset Management 7.6 and 7.5, Maximo Asset Management Essentials, several Industry Solutions, and SmartCloud Control Desk. The issue lies in the Scheduler functionality, which could allow an authenticated r...

CVE-2019-4583

CVE-2019-4583 affects IBM Maximo Asset Management core versions 7.6.0.10 and 7.6.1.1 . An authenticated user could obtain sensitive information from a stack trace, potentially aiding future attacks (CVSS v3.1 base score 4.3; vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Remediation is to ...

CVE-2019-4745

CVE-2019-4745 affects IBM Maximo Asset Management core 7.6.1.0. Root cause: path information disclosure in the URL leading to potential sensitive data exposure to an authenticated user. CVSS base score 4.3 (MEDIUM). Remediation: apply fixes for 7.6.1.0 (e.g., 7.6.1.0 iFix015 or latest Interim Fix...

CVE-2011-4817

CVE-2011-4817 affects IBM Maximo Asset Management and related IBM assets (Asset Management Essentials, Tivoli AM for IT, Service Request Manager, Maximo Service Desk, CCMDB) on multiple versions (6.2, 7.1, 7.2/7.5). The issue is an information disclosure where the About menu in Help shows the use...

CVE-2012-0728

CVE-2012-0728 is an SQL injection in IBM Maximo Asset Management 7.1–7.5 (as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and CCMDB). The vulnerability allows remote authenticated users to execute arbitrary SQL commands via ...

CVE-2012-3323

CVE-2012-3323 affects IBM Maximo Asset Management and related Maximo products: 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3. The vulnerability allows remote attackers to gain privileges via unspecified vectors (CVSS v2 base score 6.8, vector AV:N/AC:M/Au:N/C:P/I:P/A:P). IBM’s sec...

CVE-2013-3973

CVE-2013-3973 is an SQL injection vulnerability affecting IBM Maximo Asset Management and related Maximo offerings. IBM’s Security Bulletin 08A29F46834AFA86A6AA4DC93AF4EFD8AE25757E46E0D8369F58AB4F578B9B87 lists affected products (Maximo Asset Management, Maximo Asset Management Essentials, Maximo...

CVE-2013-4013

CVE-2013-4013 affects IBM Maximo Asset Management and related Maximo offerings. Affects: Maximo Asset Management 6.2.x (6.2.0–6.2.8), 7.1.x (7.1.0–7.1.1.12), and 7.5 (before 7.5.0.2). Issue: information disclosure via unspecified vectors that allow remote attackers to obtain sensitive data. CVSS ...

CVE-2013-5380

CVE-2013-5380 affects IBM Maximo Asset Management family: 6.2 (6.2.0–6.2.8), 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5. It enables local users to obtain sensitive information via unspecified vectors (information disclosure). The IBM security bulletin lists numerous product variants impacted and...

CVE-2013-5381

CVE-2013-5381 affects IBM Maximo Asset Management and related products. Affects: Maximo Asset Management 6.2 (6.2.0–6.2.8), 7.1 (up to 7.1.1.12), and 7.5 prior to 7.5.0.3. Description: remote authenticated users can gain privileges via unspecified vectors. No further technical exploit specifics a...

CVE-2013-6741

The CVE-2013-6741 issue affects IBM Maximo Asset Management and related IBM Tivoli products, allowing remote authenticated users to obtain potentially sensitive stack-trace information by triggering a Birt error. Affected products include Maximo Asset Management 7.x (before 7.1.1.7 LAFIX.20140319...

CVE-2015-4944

CVE-2015-4944 is an XSS vulnerability in IBM Maximo Asset Management and related IBM products (including SmartCloud Control Desk, Tivoli IT Asset Management for IT, and others built on affected core versions). The root cause is improper validation of user input, allowing remote authenticated atta...

CVE-2016-5896

CVE-2016-5896 affects IBM Maximo Asset Management core (7.6) and related IBM Industry Solutions/Control Desk when installed on top of affected core. Root cause: disclosure of sensitive information from a stack trace after an incorrect Cognos login attempt. Impact: information disclosure with CVSS...

CVE-2016-6072

CVE-2016-6072 affects IBM Maximo Asset Management core product (version 7.6) and related IBM Maximo Industry Solutions/Control Desk products when installed on affected cores. The vulnerability is a cross-site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potential...

CVE-2019-4644

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting in the Web UI, allowing injection of arbitrary JavaScript and potentially credential disclosure within a trusted session. Affected core versions include 7.6.0.10, 7.6.1.0, and 7.6.1.1 (with related industry solutions). IBM’s ad...

CVE-2019-4650

IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The issue affects Maximo Asset Management core product versions including 7.6.1.1; IBM’s remediation rec...

CVE-2020-4409

The CVE-2020-4409 issue affects IBM Maximo Asset Management core product versions 7.6.0 and 7.6.1, where a remote attacker could conduct phishing via a tabnabbing attack by steering a user to a crafted site and then redirecting to a trusted-appearing malicious page. Root cause is a reverse tabnab...

CVE-2021-29744

IBM Maximo Asset Management 7.6.0.x and 7.6.1.x are affected by a cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credential disclosure in a trusted session. The issue is documented with CVE-2021-29744 and has a CVSS v3.1 ba...