Skip to content
OpenAdvisories
Medium WID-SEC-2023-1403 2 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen

Published Jun 8, 2023 · Updated Jun 8, 2023 · de-DE

Vendor: IBM Product: Maximo Asset Management Product: Maximo Asset Management 7.6.1.2 Product: Maximo Asset Management 7.6.1.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial of Service zu verursachen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 2

  • High 7.5
    CVE-2022-37734

    graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources

    graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.

    com.graphql-java:graphql-java Maven
  • Medium 6.1
    CVE-2022-36033

    jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled

    jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that l…

    jhy jsoup jsoup org.jsoup:jsoup Debian Ubuntu Azure Linux Maven

Revision history

  1. #1

    Initiale Fassung

References