CVE-2017-1604

IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.

• CWE-79

• http://www.ibm.com/support/docview.wss?uid=swg22011883Vendor Advisory
• http://www.securityfocus.com/bid/103126Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/132851VDB Entry, Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=swg22011883Vendor Advisory
• http://www.securityfocus.com/bid/103126Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/132851VDB Entry, Vendor Advisory

Published

Feb 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16031Socket.io is a realtime application framework that provides …
• CVE-2017-16035The hubl-server module is a wrapper for the HubL Development…
• CVE-2017-16036`badjs-sourcemap-server` receives files sent by `badjs-sourc…
• CVE-2017-16037`gomeplus-h5-proxy` is vulnerable to a directory traversal i…
• CVE-2017-16038`f2e-server` 1.12.11 and earlier is vulnerable to a director…
• CVE-2017-16039`hftp` is a static http or ftp server `hftp` is vulnerable t…
• CVE-2017-16040gfe-sass is a library for promises (CommonJS/Promises/A,B,D)…
• CVE-2017-16041ikst versions before 1.1.2 download resources over HTTP, whi…
• CVE-2017-16042Growl adds growl notification support to nodejs. Growl befor…
• CVE-2017-16043Shout is an IRC client. Because the `/topic` command in mess…6.1
• CVE-2017-16044`d3.js` was a malicious module published with the intent to …
• CVE-2017-16045`jquery.js` was a malicious module published with the intent…