CVE-2017-1558

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 131548.

• CWE-601

• http://www.ibm.com/support/docview.wss?uid=swg22010595Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/102211Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/131548Issue Tracking, VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22010595Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/102211Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/131548Issue Tracking, VDB Entry, Vendor Advisory

Published

Dec 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15574In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS i…
• CVE-2017-15575In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm l…
• CVE-2017-15576Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time …
• CVE-2017-15577Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the r…
• CVE-2017-15578In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists vi…
• CVE-2017-15579In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists vi…
• CVE-2017-15580osTicket 1.10.1 provides a functionality to upload 'html' fi…
• CVE-2017-15581In the "Diary with lock" (aka WriteDiary) application 4.72 f…
• CVE-2017-15582In net.MCrypt in the "Diary with lock" (aka WriteDiary) appl…
• CVE-2017-15583The embedded web server on ABB Fox515T 1.0 devices is vulner…
• CVE-2017-15587An integer overflow was discovered in pdf_read_new_xref_sect…
• CVE-2017-15588An issue was discovered in Xen through 4.9.x allowing x86 PV…