CVE-2022-35281

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-352826.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted CVE-2022-352836.5IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP re CVE-2022-352847.5IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sens CVE-2022-352858.8IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious CVE-2022-352868.8IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious CVE-2022-352877.5IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its CVE-2022-352886.5IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks agains CVE-2022-352899.8A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attack CVE-2022-352907.5Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.CVE-2022-352918.1Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities wi CVE-2022-352927.8In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to CVE-2022-352939.1Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploi