Skip to content
OpenAdvisories
Medium WID-SEC-2024-0603 2 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Mar 12, 2024 · Updated Mar 12, 2024 · de-DE

Vendor: IBM Product: Maximo Asset Management Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 2

  • Medium 6.4
    CVE-2023-38723

    Maximo Asset Management cross-site scripting

    IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…

    IBM Maximo Asset Management
  • Medium 6.1
    CVE-2023-48219

    Special characters in unescaped text nodes can trigger mXSS in TinyMCE

    TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization accordi…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet

Revision history

  1. #1

    Initiale Fassung

References