Skip to content
OpenAdvisories
Medium 1 exploited CVE WID-SEC-2024-0519 7 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen

Published Feb 29, 2024 · Updated Feb 29, 2024 · de-DE

Vendor: IBM Product: Maximo Asset Management Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 7

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.1
    CVE-2023-6378

    Logback "receiver" DOS vulnerability

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback trino tez Debian Ubuntu Wolfi Maven
  • High 7.1
    CVE-2023-6481

    Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

    A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback ch.qos.logback:logback-core Maven
  • Medium 6.6
    CVE-2021-42550

    RCE from attacker with configuration edit priviledges through JNDI lookup

    In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

    QOS.ch logback logback logback Debian Ubuntu Maven
  • Medium 6.5
    CVE-2022-41915

    Netty vulnerable to HTTP Response splitting from assigning header value iterator

    Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing ma…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.5
    CVE-2023-34462

    netty-handler SniHandler 16MB allocation

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2022-41881

    HAProxyMessageDecoder Stack Exhaustion DoS

    Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

    netty netty netty netty Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References