CVE-2025-2986 – IBM Maximo Asset Management Stored Cross-Site Scripting Vulnerability

April 25, 2025

CVE ID : CVE-2025-2986

Published : April 25, 2025, 12:15 p.m. | 2 hours, 46 minutes ago

Description : IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Severity: 5.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-3912 – WordPress WS Form LITE Unauthorized Data Access Vulnerability

Next Article CVE-2025-2470 – Nextend Social Login WordPress Plugin Privilege Escalation Vulnerability

Highlights

CVE-2024-6914 – WSO2 SOAP Unauthorized Account Takeover Vulnerability

May 22, 2025

CVE ID : CVE-2024-6914

Published : May 22, 2025, 7:15 p.m. | 14 minutes ago

Description : An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges.

This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the “/services” context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the “Security Guidelines for Production Deployment” by disabling exposure to untrusted networks.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

The Ultimate Guide to Node.js Development Pricing for Enterprises

Stack Overflow: Developers’ trust in AI outputs is worsening year over year

Web Components: Working With Shadow DOM

Google’s new Opal tool allows users to create mini AI apps with no coding required

5 preinstalled apps you should delete from your Samsung phone immediately

Ubuntu Linux lagging? Try my 10 go-to tricks to speed it up

How I survived a week with this $130 smartwatch instead of my Garmin and Galaxy Ultra

YouTube is using AI to verify your age now – and if it’s wrong, that’s on you to fix

Time-Controlled Data Processing with Laravel LazyCollection Methods

Time-Controlled Data Processing with Laravel LazyCollection Methods

Create Apple Wallet Passes in Laravel

The Laravel Idea Plugin is Now FREE for PhpStorm Users

New data shows Xbox is utterly dominating PlayStation’s storefront — accounting for 60% of the Q2 top 10 game sales spots

New data shows Xbox is utterly dominating PlayStation’s storefront — accounting for 60% of the Q2 top 10 game sales spots

Opera throws Microsoft to Brazil’s watchdogs for promoting Edge as your default browser — “Microsoft thwarts‬‭ browser‬‭ competition‬‭‬‭ at‬‭ every‬‭ turn”

Activision once again draws the ire of players for new Diablo Immortal marketing that appears to have been made with generative AI

CVE-2025-2986 – IBM Maximo Asset Management Stored Cross-Site Scripting Vulnerability

CVE-2025-43234 – Apple WatchOS/IOS/iPadOS/tvOS/macOS VisionOS Texture Corruption Vulnerability

CVE-2025-43237 – Apple macOS Sequoia Write Access Vulnerability

13 Arrested in Romania Over Phishing-Based UK Tax Fraud Scheme

Researchers present bold ideas for AI at MIT Generative AI Impact Consortium kickoff event

CVE-2025-6616 – D-Link DIR-619L Stack-Based Buffer Overflow Vulnerability

CVE-2025-7552 – Dromara Northstar Remote Path Traversal Vulnerability

CVE-2024-6914 – WSO2 SOAP Unauthorized Account Takeover Vulnerability

I tested the world’s thinnest SSD enclosure – here’s why it’s the perfect PC accessory for me

CVE-2025-7819 – PHPGurukul Apartment Visitors Management System Cross-Site Scripting

CVE-2025-4001 – “Scip File Descriptor Handler Uncontrolled File Descriptor Consumption Vulnerability”

CVE-2025-2986 – IBM Maximo Asset Management Stored Cross-Site Scripting Vulnerability

Related Posts