CVE-2018-1524

CVE-2018-1524 affects IBM Maximo Asset Management 7.6 through 7.6.3, where installation includes a default administrator account that could be exploited by a remote attacker to gain administrator access. This issue stems from an incomplete fix for CVE-2015-4966. IBM's related advisories indicate ...

CVE-2019-4583

CVE-2019-4583 affects IBM Maximo Asset Management core versions 7.6.0.10 and 7.6.1.1 . An authenticated user could obtain sensitive information from a stack trace, potentially aiding future attacks (CVSS v3.1 base score 4.3; vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Remediation is to ...

CVE-2019-4745

CVE-2019-4745 affects IBM Maximo Asset Management core 7.6.1.0. Root cause: path information disclosure in the URL leading to potential sensitive data exposure to an authenticated user. CVSS base score 4.3 (MEDIUM). Remediation: apply fixes for 7.6.1.0 (e.g., 7.6.1.0 iFix015 or latest Interim Fix...

CVE-2020-4409

The CVE-2020-4409 issue affects IBM Maximo Asset Management core product versions 7.6.0 and 7.6.1, where a remote attacker could conduct phishing via a tabnabbing attack by steering a user to a crafted site and then redirecting to a trusted-appearing malicious page. Root cause is a reverse tabnab...

CVE-2014-0825

The CVE-2014-0825 entry describes an XSS vulnerability in openreport.jsp affecting IBM Maximo Asset Management 7.x (including 7.1, 7.5 ranges) and related Tivoli/SmartCloud components, where remote authenticated users can inject arbitrary web script or HTML via a crafted report parameter. The IBM...

CVE-2014-6194

CVE-2014-6194 describes a directory traversal vulnerability in IBM Maximo Asset Management and related products that allows remote authenticated users to read arbitrary files via a ".." in a pathname. Affected are IBM Maximo Asset Management 7.1–7.1.1.13; 7.5.0 before 7.5.0.6 IFIX007; Maximo Asse...

CVE-2015-0109

CVE-2015-0109 is a Cross-site Scripting (XSS) vulnerability affecting IBM Tivoli/TAM products (Maximo Asset Management, Tivoli IT Asset Management for IT, Tivoli Service Request Manager, etc.) across multiple versions (7.1–7.6, including various 7.1.1.x and 7.2 lines). The flaw allows remote auth...

CVE-2016-0222

IBM Maximo Asset Management 7.6 is affected by CVE-2016-0222; versions prior to 7.6.0.3 IFIX001 allow an authenticated remote user to bypass access controls and read arbitrary purchase-order work logs via unspecified vectors. The IBM advisory recommends applying the corresponding Fix Central inte...

CVE-2013-3971

CVE-2013-3971 affects IBM Maximo Asset Management and related products (7.1–7.1.1.12 and 7.5 before 7.5.0.5). The bulletin indicates a security bypass vulnerability that allows remote authenticated users to bypass intended access restrictions via unspecified vectors. The issue is mitigated by app...

CVE-2016-6072

CVE-2016-6072 affects IBM Maximo Asset Management core product (version 7.6) and related IBM Maximo Industry Solutions/Control Desk products when installed on affected cores. The vulnerability is a cross-site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potential...

CVE-2019-4430

CVE-2019-4430 affects IBM Maximo Asset Management 7.6. A remote attacker can exploit a path traversal flaw by sending a crafted URL containing dot-dot sequences (/../) to view arbitrary files on the system. The NVD notes a CVSSv3.1 base score of 7.5 (HIGH) with network access, low attack complexi...

CVE-2019-4644

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting in the Web UI, allowing injection of arbitrary JavaScript and potentially credential disclosure within a trusted session. Affected core versions include 7.6.0.10, 7.6.1.0, and 7.6.1.1 (with related industry solutions). IBM’s ad...

CVE-2012-6355

CVE-2012-6355 affects IBM Maximo Asset Management (versions 6.2–7.5), Maximo Asset Management Essentials (6.2–7.5), Tivoli Asset Management for IT (6.2–7.2), Tivoli Service Request Manager (7.1–7.2), Maximo Service Desk (6.2), CCMDB (7.1–7.2), and SmartCloud Control Desk (7.5). The vulnerability ...

CVE-2013-3047

CVE-2013-3047 affects IBM Maximo Asset Management family: Maximo Asset Management 7.5, 7.1 (and related solutions) 7.1.1.0–7.1.1.11, 7.5.0.0–7.5.0.5; specifically 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allow remote authenticated users to gain privileges via unspecified vectors. The IBM X-FOCU...

CVE-2013-5383

CVE-2013-5383 affects IBM Maximo Asset Management and related products (7.5, 7.1, 6.2 families; including Essentials and various industry solutions) with remote authenticated privilege escalation via unspecified vectors. The IBM Security Flash (Sept 2013) enumerates affected releases and provides...

CVE-2015-1933

CVE-2015-1933 affects IBM Maximo Asset Management and related products; the root cause is that the password input field autocomplete attribute is not set to false, enabling local attackers to obtain account information via an unattended workstation. Affected versions include Maximo Asset Manageme...

CVE-2016-0262

CVE-2016-0262 affects IBM Maximo Asset Management: Cross-site scripting (XSS) due to improper validation of user-supplied input. A remote authenticated user can inject arbitrary script/HTML via a crafted URL. Affected versions include Maximo Asset Management core products 7.6, 7.5, 7.1 and relate...

CVE-2020-4521

IBM Maximo Asset Management 7.6.0 and 7.6.1 are affected by CVE-2020-4521 due to an unsafe Java deserialization, enabling a remote authenticated attacker to execute arbitrary code. The IBM bulletin confirms the vulnerability and lists affected core product versions, with remediation guidance to a...

CVE-2013-4019

CVE-2013-4019 is an XSS vulnerability in IBM Maximo Asset Management (and related Maximo offerings) affecting 6.2.x through 6.2.8 and 7.1 up to 7.1.1.12. The description specifies remote authenticated users can inject arbitrary web script/HTML via unspecified vectors. Connected IBM bulletin detai...

CVE-2014-4765

CVE-2014-4765 affects IBM Maximo Asset Management and related IBM products (e.g., SmartCloud Control Desk, Tivoli IT Asset Management for IT, and related Maximo variants) with an information-disclosure flaw that lets remote attackers read an error message to obtain sensitive directory information...

CVE-2015-7395

CVE-2015-7395 affects IBM Maximo Asset Management and related IBM products (SmartCloud Control Desk, Tivoli IT Asset Management for IT, Service Request Manager, CRM/DB components). The issue allows a remote authenticated user to bypass work-order change restrictions due to improper access control...

CVE-2017-1357

CVE-2017-1357 affects IBM Maximo Asset Management 7.5 and 7.6 (core product), where an authenticated user can manipulate work orders to forge emails, enabling potentially more‑advanced attacks. The IBM Security Bulletin confirms the vulnerability and lists affected versions across core Maximo and...

CVE-2014-0849

CVE-2014-0849 affects IBM Maximo Asset Management and SmartCloud Control Desk (and related Tivoli MAXIMO/Tivoli products) where remote authenticated users can gain privileges by leveraging membership in two security groups. The issue is described as a privilege-escalation related to security grou...

CVE-2015-5016

CVE-2015-5016 affects IBM Maximo Asset Management family (7.6/7.5/7.1), Maximo Asset Management Essentials (7.5/7.1), plus related IBM products (Control Desk 7.5/7.6; Tivoli Asset Management for IT 7.1/7.2; others). The issue allows a remote authenticated user to bypass access restrictions and re...

CVE-2018-1697

CVE-2018-1697 affects IBM Maximo Asset Management 7.6 and possibly related IBM Maximo products when installed on affected core versions. An authenticated user could enumerate usernames by sending a specially crafted HTTP request, leading to information disclosure with a CVSS v3 base score of 4.3 ...

CVE-2020-4493

IBM Maximo Asset Management 7.6.0 and 7.6.1 are affected by CVE-2020-4493, which enables an attacker to bypass authentication and issue commands via a specially crafted HTTP command. The vulnerability affects the core Maximo Asset Management product (versions 7.6.0 and 7.6.1); IBM’s bulletin deta...

CVE-2012-3313

CVE-2012-3313 is an XSS vulnerability in IBM Maximo Asset Management 6.2–7.5 (and related products such as SmartCloud Control Desk, Tivoli AM for IT, TS RM, Maximo Service Desk, and CCMDB). The issue allows an attacker to inject arbitrary web script/HTML via unspecified vectors in affected deploy...

CVE-2012-3326

Summary: CVE-2012-3326 is a Cross-Site Scripting (XSS) vulnerability affecting IBM Maximo Asset Management 7.5 and related products (SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, CCMDB). The issue arises in the web interface allowing...

CVE-2013-4018

CVE-2013-4018 affects IBM Maximo Asset Management and related offerings: Maximo Asset Management 6.2–6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 are able to disclose sensitive information to remote authenticated users via unspecified vectors. The IBM flash bulletin and related advisories p...

CVE-2013-5402

CVE-2013-5402 is a Cross-Site Scripting (XSS) vulnerability affecting IBM Maximo Asset Management and related IBM products (Asset Management Essentials, Government, Nuclear Power, Transportation, Life Sciences, Oil and Gas, Utilities; SmartCloud Control Desk; Tivoli Asset Management for IT; Tivol...

CVE-2013-5460

CVE-2013-5460 affects IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2. The issue allows remote authenticated users to bypass intended access restrictions and read communication logs of unrelated records via unspecified vecto...

CVE-2014-3084

The CVE-2014-3084 issue affects IBM Maximo Asset Management and related products (including Maximo Asset Management Essentials, Maximo Industry Solutions, SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and CMDB products). It allows re...

CVE-2015-1951

CVE-2015-1951 affects IBM Maximo Asset Management and related products (e.g., Maximo Asset Management Essentials, several Industry Solutions, SmartCloud Control Desk, Tivoli/TAM IT products) as listed in IBM Security Bulletin. The vulnerability arises because HTTPS responses can be cached locally...

CVE-2016-9984

CVE-2016-9984 affects IBM Maximo Asset Management 7.5 and 7.6 (core product and related IBM Control Desk/industry solutions). The IBM bulletin states a remote authenticated attacker could execute arbitrary commands on the system as administrator via affected automation scripts, indicating a high-...

CVE-2019-4582

IBM Maximo Asset Management core versions 7.6.0 and 7.6.1 are vulnerable to a path traversal issue. A remote attacker can supply a crafted URL containing dot-dot sequences (/../) to view arbitrary files on the system. The CVSSv3 base score is 4.3 (MEDIUM), with Network attack vector and low privi...

CVE-2019-4671

IBM Maximo Asset Management core product versions 7.6.0 and 7.6.1 are affected by a SQL injection vulnerability. The root cause is lack of validation of externally entered SQL statements, enabling a remote attacker to view, add, modify, or delete data in the back-end database. Exploitation is rem...

CVE-2020-4526

CVE-2020-4526 affects IBM Maximo Asset Management 7.6.0 and 7.6.1, vulnerable to cross-site request forgery (CSRF) that could allow an attacker to perform malicious actions on behalf of a trusted user. The CVSS base score is 4.3 (MEDIUM). Affected product versions include Maximo Asset Management ...

CVE-2021-29743

CVE-2021-29743 concerns IBM Maximo Asset Management core products: 7.6.0.x and 7.6.1.x, affected by a stored cross‑site scripting vulnerability in the web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM Security...

CVE-2012-0727

CVE-2012-0727 is an SQL injection vulnerability affecting IBM Maximo Asset Management family (7.5, 7.1, 6.2) and related products (SmartCloud Control Desk, Tivoli AIM, Tivoli Service Request Manager, Maximo Service Desk, CCMDB). The root cause is SQL injection in certain components, allowing remo...

CVE-2012-0746

CVE-2012-0746 is an in-product Cross-Site Scripting (XSS) vulnerability affecting IBM Maximo Asset Management 7.5 and related IBM products such as SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and CCMDB. The issue is described as all...

CVE-2013-5464

CVE-2013-5464 affects IBM Maximo Asset Management 7.5.x (various subversions) and SmartCloud Control Desk 7.x. The issue allows remote authenticated users to bypass access restrictions and modify physical counts in restricted storerooms via unspecified vectors. IBM references APARs IV46277, IV465...

CVE-2014-0893

The CVE-2014-0893 entry describes a Cross-Site Scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5.x (before 7.5.0.5 IFIX006) and SmartCloud Control Desk 7.x (before 7.5.0.3 and 7.5.1.x before 7.5.1.2) where remote authenticated users can inject arbitrary web script or HTML via unspe...

CVE-2015-7451

CVE-2015-7451 is an XSS vulnerability in IBM Maximo Asset Management (and related SmartCloud Control Desk) caused by improper validation of user-supplied input. The issue affects multiple Maximo versions (7.5/7.6 and various fixes) and can be triggered by a crafted URL to execute script in a vict...

CVE-2018-1415

Summary: IBM Maximo Asset Management 7.6 is affected by a cross-site scripting (XSS) vulnerability in the Web UI. The core product versions affected are 7.6.0.5, 7.6.0.6, 7.6.0.7, and 7.6.0.8; affected installations may also include Industry Solutions and IBM Control Desk products when installed ...

CVE-2013-0451

CVE-2013-0451 affects IBM Maximo Asset Management and related Maximo/Tivoli products (6.2.x, 7.1.x, 7.5.x) with a SQL Injection vulnerability. The connected IBM bulletin describes the flaw as SQL Injection (noted as IV24726 in APARs) in the List Page Description filter and related components, ena...

CVE-2014-3026

CVE-2014-3026 is a CRLF/header-injection vulnerability in IBM Maximo Asset Management 7.5.x (including Maximo Asset Management Essentials, various Maximo Industry Solutions, and SmartCloud Control Desk 7.5). The issue allows remote authenticated users to inject arbitrary HTTP headers and perform ...

CVE-2016-9976

Summary of CVE-2016-9976 : IBM Maximo Asset Management (core product) versions 7.1, 7.5, and 7.6 are affected. A remote attacker can send a specially crafted URL request to include arbitrary files, potentially leading to arbitrary code execution on the vulnerable server. The IBM Security Bulletin...

CVE-2017-1176

CVE-2017-1176 affects IBM Maximo Asset Management 7.1, 7.5, and 7.6. It is a local information-disclosure vulnerability caused by inappropriate retention of attachments, allowing a local user to obtain sensitive information. The NVD notes partial confidentiality impact (C) with low overall severi...

CVE-2018-1414

CVE-2018-1414 affects IBM Maximo Asset Management core products: 7.6 and 7.5 (and Maximo Asset Management Essentials 7.5), with a SQL injection vulnerability that enables a remote attacker to view, add, modify, or delete data in the back-end database. The root cause is an injectable SQL path in t...

CVE-2018-1528

IBM Maximo Asset Management 7.6 (core) is affected by CVE-2018-1528, allowing an authenticated user to obtain sensitive information via the WhoAmI API, with CVSSv3 base score 4.3 (LOW to MEDIUM range depending on vector). The IBM Security Bulletin lists affected versions (7.6 and all dependent IB...