CVE-2026-105052: fallo de gravedad alta en IBM Maximo Application Suite
IBM Maximo Application Suite Information Disclosure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.4%
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
IBM · Maximo Application SuiteCVEs relacionadas — IBM Maximo Application Suite
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-22328HIGHIBM Maximo Application Suite information disclosureEPSS 0.8%CVE-2023-32334LOWIBM Maximo Asset Management information disclosureEPSS 0.6%CVE-2023-32332MEDIUMIBM Maximo Application Suite and IBM Maximo Asset Management HTML injectionEPSS 0.6%CVE-2023-32335LOWIBM Maximo Application Suite information disclosureEPSS 0.5%CVE-2022-35645MEDIUMIBM Maximo Asset Management cross-site scriptingEPSS 0.5%CVE-2026-18531MEDIUMIBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session SecretEPSS 0.4%