CVE-2019-4446
published 2020-04-17CVE-2019-4446: IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.78%
52.1th percentile
IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | control_desk | — | — |
| ibm | control_desk | — | — |
| ibm | maximo_asset_configuration_manager | — | — |
| ibm | maximo_asset_configuration_manager | — | — |
| ibm | maximo_asset_configuration_manager | — | — |
| ibm | maximo_asset_health_insights | — | — |
| ibm | maximo_asset_health_insights | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management | — | — |
| ibm | maximo_asset_management_scheduler | — | — |
| ibm | maximo_asset_management_scheduler | — | — |
| ibm | maximo_asset_management_scheduler | — | — |
| ibm | maximo_asset_management_scheduler_plus | — | — |
| ibm | maximo_asset_management_scheduler_plus | — | — |
| ibm | maximo_asset_management_scheduler_plus | — | — |
| ibm | maximo_calibration | — | — |
| ibm | maximo_enterprise_adapter | — | — |
| ibm | maximo_enterprise_adapter | — | — |
| ibm | maximo_for_aviation | — | — |
| ibm | maximo_for_aviation | — | — |
| ibm | maximo_for_aviation | — | — |
| ibm | maximo_for_life_sciences | — | — |
| ibm | maximo_for_nuclear_power | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-69xc-p83f-62p4: IBM Maximo Asset Management 7
ghsa_unreviewed·2022-05-24
CVE-2019-4446 [MEDIUM] CWE-862 GHSA-69xc-p83f-62p4: IBM Maximo Asset Management 7
IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.
OSV
squid3 regression
osv·2020-08-27·CVSS 7.5
CVE-2019-12520 squid3 regression
squid3 regression
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a
regression when using Squid with the icap or ecap protocols. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote
attacker could possibly use this issue to bypass certa
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-17
Published