CVE-2022-40616

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
IBM	Maximo Asset Management	7.6.1.1; 7.6.1.2; 7.6.1.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/236311VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6621599Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/236311VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6621599Vendor Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406177.5strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and i CVE-2022-406197.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affe CVE-2022-40627.8A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker g CVE-2022-406207.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when down CVE-2022-406217.5Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and CVE-2022-406228.8The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use sessio CVE-2022-406238.8The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with o CVE-2022-406249.8pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different CVE-2022-406266.1An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated use CVE-2022-406289.8This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (in CVE-2022-406297.5This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (in CVE-2022-40639.8The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to