CVE-2018-2028

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID: 155554.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.6

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/155554VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880145Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/155554VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880145Patch, Vendor Advisory

Timeline

Published: Jun 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202986.5S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NT CVE-2018-202999.8An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. CVE-2018-203009.8Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this CVE-2018-203016.5An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registrat CVE-2018-203026.1An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.CVE-2018-203037.5In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a fi CVE-2018-203046.5wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argum CVE-2018-203059.8D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/fo CVE-2018-203065.4A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow CVE-2018-203074.3Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical CVE-2018-203098.1Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-bas CVE-2018-203108.1Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu