IBM Maximo Anywhere vulnerabilities

11 CVEs affecting IBM Maximo Anywhere, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4352, published 2022-02-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-4945, published 2015-07-26. Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days. Unspecified vulnerability in the IBM Maximo Anywhere application 7.5.1 through 7.5.1.2 for Android allows attackers to bypass a passcode protection mechanism and obtain sensitive information via a…
CVE-2017-1604, published 2018-02-21. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2019-4429, published 2020-02-19. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2019-4291, published 2022-02-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 160697.
CVE-2019-4265, published 2019-10-10. Low severity, CVSS 2.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198.
CVE-2019-4288, published 2020-04-29. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160631.
CVE-2019-4286, published 2020-04-29. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160514.
CVE-2019-4349, published 2020-11-03. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the confidentiality and integrity of the…
CVE-2019-4266, published 2020-05-06. Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID:…
CVE-2019-4352, published 2022-02-16. Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.

Latest

CVE-2019-4351, published 2022-02-16. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493.