CVE-2017-1357

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.5; 7.6

References

http://www.ibm.com/support/docview.wss?uid=swg22006647Vendor Advisory
http://www.securityfocus.com/bid/100214Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126684VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006647Vendor Advisory
http://www.securityfocus.com/bid/100214Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126684VDB Entry, Vendor Advisory

Timeline

Published: Aug 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-13595.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-13627.8IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-F CVE-2017-13635.4IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web CVE-2017-13645.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-136486.5In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.CVE-2017-136495.5UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbi CVE-2017-13655.4IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. T CVE-2017-136526.5NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perfo CVE-2017-136586.5In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to CVE-2017-13667.5IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow a CVE-2017-136637.5Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed CVE-2017-136649.8Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with ad