rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-2883 
Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0387.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-02T14:00:00.000Z
CVE-2016-2884 
Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T20:00:00.000Z
CVE-2016-2887 
IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T20:00:00.000Z
CVE-2016-2888 
Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0313 and CVE-2016-0350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-08T01:00:00.000Z
CVE-2016-2889 
Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-08T01:00:00.000Z
CVE-2016-2894 
IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T21:00:00.000Z
CVE-2016-2901 
Cross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-26T01:00:00.000Z
CVE-2016-2908 
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: Access Manager
Published: 2017-02-01T20:00:00.000Z
CVE-2016-2912 
Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-08T01:00:00.000Z
CVE-2016-2914 
Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-08T01:00:00.000Z
CVE-2016-2917 
The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information, and consequently gain privileges, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T20:00:00.000Z
CVE-2016-2922 
IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational ClearQuest
Published: 2018-08-13T16:00:00.000Z
CVE-2016-2923 
IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-07T14:00:00.000Z
CVE-2016-2924 
IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: BigInsights
Published: 2017-02-01T22:00:00.000Z
CVE-2016-2925 
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF30, 8.0.0.x through 8.0.0.1 CF21, and 8.5.0 before CF10 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-08T01:00:00.000Z
CVE-2016-2926 
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Team Concert 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6.0.2 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T20:00:00.000Z
CVE-2016-2927 
IBM BigFix Remote Control before 9.1.3 does not properly restrict the set of available encryption algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T20:00:00.000Z
CVE-2016-2928 
IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T20:00:00.000Z
CVE-2016-2929 
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T20:00:00.000Z
CVE-2016-2930 
IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: BigFix Remote Control
Published: 2017-05-03T17:00:00.000Z
CVE-2016-2931 
IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2932 
IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2933 
Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2934 
Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2935 
The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2936 
IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2937 
IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2938 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2, 8.5.3, 9.0.1.1, 8.0.2, 8.0, 8.0.1, 8.5.1.5, 8.5.2.4, 9.0.1.2, 8.5.0.1, 9.0.1.3, 8.5.1.4, 9.0.1.4, 9.0.1.5, 8.5.1.1, 9.0.1.6, 9.0.1.7
Published: 2017-02-01T20:00:00.000Z
CVE-2016-2939 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Domino
Published: 2017-02-01T20:00:00.000Z
CVE-2016-2940 
Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2941 
IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-02-01T22:00:00.000Z
CVE-2016-2942 
IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent machine.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-02-01T22:00:00.000Z
CVE-2016-2943 
IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2944 
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2945 
The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-08T01:00:00.000Z
CVE-2016-2946 
Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on Linux and UNIX allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-01T11:00:00.000Z
CVE-2016-2947 
IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allow remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T03:38:00.000Z
CVE-2016-2948 
IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2949 
IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2950 
SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2951 
IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2952 
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2953 
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2954 
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2956 and CVE-2016-3008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-01T10:00:00.000Z
CVE-2016-2955 
Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-01T11:00:00.000Z
CVE-2016-2956 
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2954 and CVE-2016-3008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-01T10:00:00.000Z
CVE-2016-2957 
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace in a response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2958 
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic" e-mail address in a response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2959 
IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2960 
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-08T01:00:00.000Z
CVE-2016-2961 
The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-02T14:00:00.000Z
CVE-2016-2963 
Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-2964 
IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM X-Force ID: 113813.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T21:00:00.000Z
CVE-2016-2965 
IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious link, a remote attacker could force the user to log out of Sametime. IBM X-Force ID: 113846.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2966 
IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T21:00:00.000Z
CVE-2016-2967 
IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113848.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T21:00:00.000Z
CVE-2016-2968 
IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-02T14:00:00.000Z
CVE-2016-2969 
IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2970 
IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-28T20:00:00.000Z
CVE-2016-2971 
IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Force ID: 113898.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2972 
IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by a local user. IBM X-Force ID: 113855.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2973 
IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113899.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-2974 
IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as other users on the local machine of the user. IBM X-Force ID: 113934.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T21:00:00.000Z
CVE-2016-2975 
IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113935.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T21:00:00.000Z