CVE-2018-1698

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 145967.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.6; 7.6.0; 7.6.0.1; 7.6.1; 7.6.2; 7.6.2.1; 7.6.2.2; 7.6.2.3; 7.6.2.4; 7.6.3

References

http://www.securityfocus.com/bid/105343Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/145967VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728857Patch, Vendor Advisory
http://www.securityfocus.com/bid/105343Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/145967VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728857Patch, Vendor Advisory

Timeline

Published: Sep 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-169806.1dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.CVE-2018-169818.8stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function CVE-2018-169825.5Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in Bi CVE-2018-169839.8NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html CVE-2018-169844.9An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read CVE-2018-169857.5In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_com CVE-2018-169868.8Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malforme CVE-2018-169877.2Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-p CVE-2018-169889.8An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechani CVE-2018-16998.8IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,CVE-2018-169947.5An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth CVE-2018-169995.5Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to