CVE-2021-20509

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.6.0; 7.6.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/198243VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6480377Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/198243VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6480377Vendor Advisory

Timeline

Published: Aug 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20517.6Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that ar CVE-2021-205104.4IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 1982 CVE-2021-205114.9IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a speci CVE-2021-205156.7IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged use CVE-2021-205178.8IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An atta CVE-2021-205185.4IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t CVE-2021-205195.4IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2021-20525.8Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). The suppo CVE-2021-205205.4IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t CVE-2021-205232.7IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error messa CVE-2021-205244.8IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip CVE-2021-205265.3IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A