Kapil Khot

**Name of the Vulnerable Software and Affected Versions** IBM Maximo Application Suite version 9.0 **Description** The issue allows an authenticated user to upload a file with dangerous types that could be executed by another user if opened. **Recommendations** For IBM Maximo Application Suite version 9.0, consider restricting file upload capabilities to prevent the upload of dangerous file types until a fix is available. As a temporary workaround, limit access to file uploads to trusted users and ensure that all uploaded files are thoroughly scanned for malicious content.

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270 Description: The issue allows an authenticated, remote attacker with limited privileges to potentially exploit multiple Blind SQL Injection vulnerabilities. This could enable the attacker to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data. Recommendations: For versions prior to 9.0.270, update to version 9.0.270 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270 Description: The issue allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges and use the appliance to visit a malicious link that exploits this issue, causing the application to perform sensitive actions. Recommendations: For Quest Kace K1000 Appliance versions prior to 9.0.270, update to version 9.0.270 or later to resolve the issue. As a temporary workaround, consider restricting access to the appliance's settings and administrator account management functions until a patch is applied.