MA
Product
Maximo Application Suite
35
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 13Medium 19Low 2
Watch
Add Maximo Application Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-43037 | 6.5 | Apr 10 | IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation Affected: 8.11 before 8.11.13; 9.0 |
| CVE-2023-38723 | 6.4 | Mar 13 | IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting Affected: 7.6.1.3 |
| CVE-2024-35145 | 6.1 | Jan 25 | IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting Affected: 9.0 |
| CVE-2024-38314 | 5.9 | Oct 24 | IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised… Affected: 8.10 before 8.10.15; 8.11 before 8.11.12; 9.0 before 9.0.4 |
| CVE-2023-27861 | 5.9 | Jun 5 | IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle… Affected: 8.8.0; 8.9.0 |
| CVE-2022-43923 | 5.5 | Feb 24 | IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user Affected: 8.8.0; 8.9.0 |
| CVE-2022-41732 | 5.5 | Nov 28 | IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user Affected: 8.7; 8.8 |
| CVE-2024-35146 | 5.4 | Nov 6 | IBM Maximo Application Suite - Monitor Component 8.10.11, 8.11.8, and 9.0.0 is vulnerable to cross-site scripting Affected: 8.10.11; 8.11.8; 9.0 |
| CVE-2023-32337 | 5.4 | Jan 19 | IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery (SSRF) Affected: 8.10 before 8.10.6; 8.11 through 8.11.2 |
| CVE-2023-32332 | 5.4 | Sep 8 | IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection Affected: 8.9; 8.10 |
| CVE-2022-35645 | 5.4 | Mar 2 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting Affected: 8.8.0; 8.9.0 |
| CVE-2021-29743 | 5.4 | Aug 30 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting Affected: 8.0 through 8.4 |
| CVE-2021-29744 | 5.4 | Aug 27 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting Affected: 8.4 |
| CVE-2026-18531 | 5.3 | Aug 5 | IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret Affected: 9.2; 9.1; 9.0 |
| CVE-2024-35150 | 5.3 | Jan 25 | IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject… Affected: 8.10.12 before 8.10.15; 8.11 before 8.11.13; 9.0.1 before 9.0.5; 9.1.0 |
| CVE-2024-35144 | 5.3 | Jan 25 | IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system Affected: 8.10 before 8.10.14; 8.11 before 8.11.11; 9.0 |
| CVE-2023-32334 | 5.3 | Jun 5 | IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters Affected: 8.8.0 |
| CVE-2026-15656 | 4.3 | Aug 5 | IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret Affected: 9.2; 9.1; 9.0 |
| CVE-2026-4820 | 4.3 | Apr 1 | IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag Affected: 9.1.0 through 10.6.5.0; 9.0; 8.11.0; 8.10 |
Showing 19