CVE-2018-1528

IBM Maximo Asset Management 7.6 (core) is affected by CVE-2018-1528, allowing an authenticated user to obtain sensitive information via the WhoAmI API, with CVSSv3 base score 4.3 (LOW to MEDIUM range depending on vector). The IBM Security Bulletin lists affected versions (7.6 and all dependent IB...

CVE-2019-4591

IBM Maximo Asset Management 7.6.0 and 7.6.1 are vulnerable to an authentication bypass: the product does not invalidate a session after logout, which could allow a local user to impersonate another user on the system. ROOT CAUSE: improper session handling after logout in the affected core version...

CVE-2023-47718

CVE-2023-47718 affects IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10–8.11, with a cross-site request forgery (CSRF) flaw that could allow an attacker to perform authenticated actions on behalf of a trusted user. The issue is caused by CSRF token handling in IBM Maximo Manage/Asset...

CVE-2013-4017

CVE-2013-4017 is an SQL injection vulnerability in IBM Maximo Asset Management 7.1 prior to 7.1.1.12, enabling remote execution of arbitrary SQL via unspecified vectors. The IBM security bulletin lists affected products including Maximo Asset Management and related offerings across 6.2–7.5 lines,...

CVE-2013-4020

CVE-2013-4020 affects IBM Maximo Asset Management and related products: Maximo Asset Management 6.2.x, 7.1.x, and 7.5 prior to 7.5.0.3 allow remote authenticated users to bypass access restrictions via unspecified vectors. The connected IBM bulletin and NVD entry confirm the affected versions and...

CVE-2016-0393

IBM Maximo Asset Management (core product) 7.6 and 7.5, including related Industry Solutions and IBM Control Desk products that are installed on affected cores, are vulnerable to information disclosure via log files exposing sensitive URL data (CVE-2016-0393). The issue affects 7.6 and 7.5 lines ...

CVE-2016-0399

CVE-2016-0399 affects IBM Maximo Asset Management core (versions 7.6, 7.5, 7.1) and related IBM products when deployed on top of affected cores. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user-supplied input, allowing a remote authenticated attacker to...

CVE-2018-1698

CVE-2018-1698 – IBM Maximo Asset Management : Affects core Maximo Asset Management 7.6 (and related Industry Solutions / IBM Control Desk variants) where an unauthenticated attacker could obtain sensitive information from error messages. The root cause is tied to information disclosure via error ...

CVE-2019-4446

IBM Maximo Asset Management 7.6.x is affected by CVE-2019-4446 through insecure permissions that allow an authenticated user to perform actions by modifying request parameters. Affected core Product versions: 7.6.0, 7.6.1, and 7.6.1.1 (including related Industry Solutions and IBM Control Desk com...

CVE-2013-0457

The CVE-2013-0457 entry concerns a Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5. The issue allows remote authenticated users to inject arbitrary web script or HTML through vectors related to a ...

CVE-2016-8924

CVE-2016-8924 affects IBM Maximo Asset Management core versions 7.1, 7.5 and 7.6 (and related Industry Solutions/Control Desk products). The vulnerability stems from failing to invalidate an existing session identifier, enabling remote session hijacking to access another user’s session. IBM’s Sec...

CVE-2012-3333

CVE-2012-3333 affects IBM Maximo Asset Management and SmartCloud Control Desk via a CRLF injection that allows HTTP header manipulation and HTTP response splitting through crafted URL parameters. Affected products include Maximo Asset Management and related variants across 7.5/7.1/6.2 lines and S...

CVE-2013-3972

CVE-2013-3972 affects IBM Maximo Asset Management (and related Maximo offerings): versions 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 are vulnerable to an information-disclosure condition triggered by remote authenticated users via unspecified vectors. IBM’s consolidated bulletin shows the vulner...

CVE-2016-5902

CVE-2016-5902 affects IBM Maximo Asset Management. The IBM bulletin documents a cross-site scripting flaw in the Web UI that can lead to credential disclosure within a trusted session. Affected core versions: 7.6, 7.5, 7.1 (with various Industry Solutions/SmartCloud components on these cores). Ro...

CVE-2016-5905

IBM Maximo Asset Management is affected by CVE-2016-5905: cross-site scripting in the Maximo Asset Management core product (versions 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2). The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vect...

CVE-2016-9977

CVE-2016-9977 affects IBM Maximo Asset Management core products 7.1, 7.5, and 7.6 (and related Industry Solutions and IBM Control Desk on top) with a vulnerability that allows remote session hijacking due to failure to invalidate an existing session identifier. Affected products include Maximo As...

CVE-2018-1584

CVE-2018-1584 affects IBM Maximo Asset Management 7.6 core. Affected component: Web UI where cross-site scripting (XSS) can be injected, enabling arbitrary JavaScript execution that may lead to credentials disclosure within a trusted session. CVSSv3 base score 5.4 (MEDIUM). IBM’s bulletin lists a...

CVE-2018-1872

CVE-2018-1872 affects IBM Maximo Asset Management 7.6, with a cross-site scripting vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The vulnerability is documented across multiple sources (IBM X-For...

CVE-2013-4014

CVE-2013-4014 is a cross-site scripting (XSS) vulnerability affecting IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM’s bulletin lists affected product...

CVE-2013-4021

CVE-2013-4021 affects IBM Maximo Asset Management and related products (Maximo Asset Management 6.2.x up to 6.2.8; 7.1 up to 7.1.1.12; 7.5 up to 7.5.0.5) and several IBM Maximo/Tivoli components. The vulnerability is described as an unspecified remote file-inclusion issue exploitable by remote au...

CVE-2013-5395

CVE-2013-5395 affects IBM Maximo Asset Management and related products. Affected: Maximo Asset Management 6.2–6.2.8; 7.1 before 7.1.1.12; 7.5 before 7.5.0.5. Issue: remote attackers can bypass intended access restrictions via unspecified vectors. Evidence: IBM Flash with detailed product list and...

CVE-2016-5987

CVE-2016-5987 affects IBM Maximo Asset Management core versions 7.6, 7.5, and 7.1 (and related IBM products built on those cores). A remote attacker could obtain sensitive information by sending a crafted HTTP request that triggers the construction of a runtime error message, leading to an inform...

CVE-2018-1554

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting in the Web UI. The issue allows injection of arbitrary JavaScript code, potentially leading to credentials disclosure within a trusted session. Root cause is a client-side XSS in the Maximo Web UI. Affected products include the...

CVE-2018-1686

IBM Maximo Asset Management 7.6 (core) through 7.6.3 is affected by a cross-site scripting (XSS) vulnerability that lets an attacker inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. The condition affects core Maximo 7.6 and may a...

CVE-2019-4478

IBM Maximo Asset Management has a CVE-2019-4478 information-disclosure vulnerability affecting core product versions 7.6.0 and 7.6.1 (and 7.6.1.1 per IBM bulletin). An authenticated user could obtain highly sensitive information they should not access. CVSS vectors listed include High confidentia...

CVE-2013-4027

CVE-2013-4027 affects IBM Maximo Asset Management and related products (Maximo Asset Management 6.2.x, 7.1.x, 7.5) where remote authenticated users can bypass access restrictions via unspecified vectors. The connected IBM bulletin confirms vulnerable components and lists FIX/IF packages per relea...

CVE-2023-32335

Summary: CVE-2023-32335 affects IBM Maximo Application Suite and IBM Maximo Asset Management. Affected versions: MAS 8.10–8.11 and IBM Maximo Asset Management 7.6.1.3. Root cause / impact: The vulnerable components store sensitive information in URL parameters, enabling information disclosure if ...

CVE-2013-3048

CVE-2013-3048 is an XSS vulnerability in IBM Maximo Asset Management and related Maximo products across multiple releases (6.2.x to 7.5). The issue allows remote authenticated users to inject arbitrary web script/HTML via unspecified vectors due to a cross-site scripting flaw. IBM’s bulletin list...

CVE-2018-1699

IBM Maximo Asset Management version 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send crafted SQL to view, add, modify, or delete data in the back-end database. Affected products include Maximo Asset Management core 7.6 (and related Industry Solutions and IBM Control ...

CVE-2012-6357

Technical details about CVE-2012-6357 are not publicly provided in the connected documents. The initial description lists affected IBM Maximo products but does not disclose vulnerability specifics, vectors, or remediation. Monitor for updates.

CVE-2020-4223

CVE-2020-4223 affects IBM Maximo Asset Management core product versions 7.6.0.10 and 7.6.1.1. The issue is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. The prim...

CVE-2016-8987

CVE-2016-8987 - IBM Maximo Asset Management could allow an authenticated user to view incorrect item sets they should not access. Affected core versions: Maximo Asset Management 7.6, 7.5, 7.1, plus related Industry Solutions (Maximo for Aviation, Life Sciences, Nuclear Power, Oil and Gas, Transpo...