CVE-2014-0914

IBM Maximo Asset Management 6.2-6.2.8, 6.x-7.5.0.6, 7.5-7.5.0.3, 7.5.1-7.5.1.2 - Stored XSS via Query Description

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management for IT and Maximo Service Desk allows remote authenticated users to inject arbitrary web script or HTML via the Query Description Field.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68839
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59640
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/533110/100/0/threaded
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21678885
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV56679
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59570
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/91883

Scores

EPSS 0.0107
EPSS Percentile 61.4%

Details

CWE
CWE-79
Status published
Products (50)
ibm/maximo_asset_management 6.2
ibm/maximo_asset_management 6.2.1
ibm/maximo_asset_management 6.2.2
ibm/maximo_asset_management 6.2.3
ibm/maximo_asset_management 6.2.4
ibm/maximo_asset_management 6.2.5
ibm/maximo_asset_management 6.2.6
ibm/maximo_asset_management 6.2.6.1
ibm/maximo_asset_management 6.2.7
ibm/maximo_asset_management 6.2.8
... and 40 more
Published Jul 30, 2014
Tracked Since Feb 18, 2026