Control Desk

Vendor:

First CVE: Mar 27, 2018 · Active for 8 years

15

Total CVEs

More Total CVEs than 92% of tracked products

3.0

Avg CVEs / Year

Higher CVE frequency than 76% of tracked products

5.4

Avg CVSS

Higher Avg CVSS than 11% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Control Desk over time

Volume of CVEsAvg CVSS Base Score

First CVE

Mar 27, 2018

8 years ago

Most Recent CVE

Sep 13, 2022

1,411 days ago

CVE Severity & Scoring

Control Desk15 CVEs

80%

13%

All CVEs352,427 CVEs

45%

40%

11%

LowMediumHigh

Attack Vector

Local0 (0.0%)

Network14 (93.3%)

Unknown0 (0.0%)

Physical1 (6.7%)

Adjacent Network0 (0.0%)

Attack Complexity

Low15 (100.0%)

High0 (0.0%)

Unknown0 (0.0%)

User Interaction

None7 (46.7%)

Unknown0 (0.0%)

Required8 (53.3%)

Privileges Required

Low11 (73.3%)

High0 (0.0%)

None4 (26.7%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (15 CVEs).

15 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2019-4364HIGH IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680	Jun 19, 2019	8.0	26	NO	NO
CVE-2018-2028MEDIUM IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive informat	Jun 6, 2019	6.5	22	NO	NO
CVE-2020-4409HIGH IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafte	Sep 16, 2020	8.2	21	NO	NO
CVE-2019-4644MEDIUM IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f	Apr 17, 2020	6.1	21	NO	NO
CVE-2019-4303MEDIUM IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f	Jun 19, 2019	5.4	21	NO	NO
CVE-2022-22330MEDIUM IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerabi	Sep 13, 2022	5.3	20	NO	NO
CVE-2019-4749MEDIUM IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f	Apr 17, 2020	5.4	19	NO	NO
CVE-2019-4446MEDIUM IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.	Apr 17, 2020	5.4	19	NO	NO
CVE-2019-4429MEDIUM IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th	Feb 19, 2020	5.4	19	NO	NO
CVE-2022-22329MEDIUM IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a u	Sep 13, 2022	4.3	18	NO	NO

View all 15 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (15 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (15 CVEs).

Media Mentions

Signals from CVEs in this product scope (15 CVEs).

Top CNAs Publishing CVEs For Control Desk

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
7.6.1.3	3	5.0	0.6%
7.6.1.2	3	5.0	0.6%
7.6.1.1	7	5.7	0.7%
7.6.1	8	5.3	0.7%
7.6.0.1	8	5.0	1.0%
7.6.0	8	5.0	1.0%
7.6	1	4.3	1.0%
7.5	1	4.3	1.0%