Maximo Asset Management@7.6 Security Vulnerabilities and Issues — Maximo Asset Management@7.6 CVE List

Lucene search

IbmMaximo Asset Management7.6

48 matches found

CVE•added 2019/06/06 1:29 a.m.•76 views

CVE-2019-4048

IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311.

2.1CVSS3.1AI score0.00079EPSS

CVE•added 2019/06/06 1:29 a.m.•63 views

CVE-2019-4056

IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565.

4.3CVSS4.5AI score0.00214EPSS

CVE•added 2019/06/19 2:15 p.m.•63 views

CVE-2019-4364

IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680.

8.5CVSS7.6AI score0.01296EPSS

CVE•added 2019/06/19 2:15 p.m.•62 views

CVE-2019-4303

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949.

5.4CVSS5.2AI score0.00229EPSS

CVE•added 2019/06/06 1:29 a.m.•59 views

CVE-2018-2028

IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID: 155554.

6.5CVSS6AI score0.00087EPSS

CVE•added 2019/10/24 12:15 p.m.•53 views

CVE-2019-4486

5.4CVSS5.2AI score0.00211EPSS

CVE•added 2017/05/26 4:29 p.m.•50 views

CVE-2017-1292

IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153.

5.3CVSS5AI score0.00185EPSS

CVE•added 2019/11/20 5:15 p.m.•49 views

CVE-2019-4530

IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586.

6.5CVSS6.1AI score0.00215EPSS

CVE•added 2017/03/07 5:59 p.m.•48 views

CVE-2017-1124

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053.

2.9CVSS3.5AI score0.00046EPSS

CVE•added 2016/01/02 9:59 p.m.•45 views

CVE-2015-7396

The Scheduler in IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.1 FP1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.1 FP1 for SmartCloud Control Desk allows remote authenticated users to bypass intended access restrictions, and obtain sensi...

5.5CVSS5AI score0.00133EPSS

CVE•added 2017/12/13 6:29 p.m.•45 views

CVE-2017-1558

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malic...

6.1CVSS5.9AI score0.00177EPSS

CVE•added 2020/04/17 2:15 p.m.•45 views

CVE-2019-4749

5.4CVSS5.2AI score0.00158EPSS

CVE•added 2016/01/03 5:59 a.m.•44 views

CVE-2015-5051

IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified ve...

4.3CVSS4.3AI score0.00137EPSS

CVE•added 2017/07/05 5:29 p.m.•44 views

CVE-2017-1175

IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123297.

9.8CVSS9.3AI score0.00675EPSS

CVE•added 2018/02/14 3:29 p.m.•44 views

CVE-2017-1499

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 129106.

8.8CVSS8.7AI score0.02065EPSS

CVE•added 2016/04/05 5:59 p.m.•43 views

CVE-2016-0289

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors.

4.3CVSS4.1AI score0.00093EPSS

CVE•added 2018/08/16 1:29 p.m.•43 views

CVE-2018-1715

IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 1470...

5.4CVSS5.2AI score0.0021EPSS

CVE•added 2017/05/26 4:29 p.m.•42 views

CVE-2017-1291

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks,...

5.4CVSS5.4AI score0.00146EPSS

CVE•added 2016/01/27 5:59 a.m.•41 views

CVE-2015-7487

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for T...

4.9CVSS4.1AI score0.00052EPSS

CVE•added 2020/04/17 2:15 p.m.•41 views

CVE-2019-4644

6.1CVSS5.8AI score0.00166EPSS

CVE•added 2017/02/01 8:59 p.m.•40 views

CVE-2016-5896

IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser.

5.3CVSS5AI score0.00187EPSS

CVE•added 2017/07/05 5:29 p.m.•40 views

CVE-2017-1208

IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 1237...

5.4CVSS5.2AI score0.00269EPSS

CVE•added 2017/09/12 9:29 p.m.•40 views

CVE-2017-1352

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538.

6CVSS5.3AI score0.00328EPSS

CVE•added 2016/01/03 5:59 a.m.•39 views

CVE-2015-5017

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for T...

5.5CVSS5.2AI score0.00105EPSS

CVE•added 2017/08/09 6:29 p.m.•39 views

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684.

4.3CVSS4.4AI score0.00215EPSS

CVE•added 2018/03/27 5:29 p.m.•38 views

CVE-2015-5016

IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and 7.2; and certain other IBM products allow remote authenticated users to bypass intended access restrictions and read arbitrary ticket workl...

4.3CVSS4.2AI score0.00105EPSS

CVE•added 2016/01/02 9:59 p.m.•38 views

CVE-2015-7452

IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.

4.3CVSS4.2AI score0.00155EPSS

CVE•added 2018/08/03 3:29 p.m.•38 views

CVE-2018-1524

IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to the system. This vulnerability is due to an incomplete fix for CVE-2015-4966. IBM X-Force ID: 142116.

9CVSS8.5AI score0.00393EPSS

CVE•added 2016/01/02 5:59 a.m.•37 views

CVE-2015-7451

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web scrip...

5.4CVSS5AI score0.00168EPSS

CVE•added 2018/12/05 5:29 p.m.•37 views

CVE-2018-1697

IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. IBM X-Force ID: 145966.

4.3CVSS4.3AI score0.00057EPSS

CVE•added 2017/05/03 5:59 p.m.•36 views

CVE-2016-9976

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252.

8.4CVSS8.4AI score0.02205EPSS

CVE•added 2018/08/06 2:29 p.m.•36 views

CVE-2018-1528

IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. IBM X-Force ID: 142290.

4.3CVSS4.1AI score0.00163EPSS

CVE•added 2017/06/13 7:29 p.m.•35 views

CVE-2016-9984

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force ID: 120276.

8.8CVSS8.6AI score0.02587EPSS

CVE•added 2017/07/05 5:29 p.m.•35 views

CVE-2017-1176

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM X-Force ID: 123299.

3.3CVSS3.5AI score0.00054EPSS

CVE•added 2020/04/17 2:15 p.m.•35 views

CVE-2019-4446

IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.

5.5CVSS5.2AI score0.00116EPSS

CVE•added 2017/02/08 10:59 p.m.•34 views

CVE-2016-5902

IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

6.1CVSS5.9AI score0.00317EPSS

CVE•added 2017/06/07 5:29 p.m.•34 views

CVE-2016-9977

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253.

8.8CVSS8.4AI score0.01047EPSS

CVE•added 2018/02/22 7:29 p.m.•34 views

CVE-2018-1415

5.4CVSS5.2AI score0.00269EPSS

CVE•added 2019/07/17 2:15 p.m.•33 views

CVE-2019-4430

IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162887.

7.5CVSS7.2AI score0.00533EPSS

CVE•added 2017/04/26 5:59 p.m.•32 views

CVE-2016-8924

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537.

5.6CVSS5.6AI score0.00207EPSS

CVE•added 2018/02/22 7:29 p.m.•32 views

CVE-2018-1414

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 138820.

8.8CVSS8.7AI score0.00648EPSS

CVE•added 2018/11/28 5:0 p.m.•32 views

CVE-2018-1584

5.4CVSS5.2AI score0.00229EPSS

CVE•added 2018/09/13 3:29 p.m.•32 views

CVE-2018-1698

IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 145967.

5.3CVSS4.9AI score0.00433EPSS

CVE•added 2018/11/09 5:0 p.m.•32 views

CVE-2018-1872

5.4CVSS5.2AI score0.00229EPSS

CVE•added 2018/08/02 2:29 p.m.•31 views

CVE-2018-1554

5.4CVSS5.2AI score0.00216EPSS

CVE•added 2018/10/05 1:29 p.m.•29 views

CVE-2018-1686

5.4CVSS5.2AI score0.00158EPSS

CVE•added 2018/08/24 11:0 a.m.•28 views

CVE-2018-1699

IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145968.

8.8CVSS8.6AI score0.00512EPSS

CVE•added 2017/06/08 9:29 p.m.•27 views

CVE-2016-8987

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view.

4.3CVSS4.4AI score0.00212EPSS