CVE-2016-0354

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
IBM	Sametime	8.5.2; 8.5.2.1; 9.0; 9.0.0.1; 9.0.1

References

http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/111893VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/111893VDB Entry, Vendor Advisory

Timeline

Published: Aug 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-03556.5IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to CVE-2016-03566.5IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to CVE-2016-03574.3IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduc CVE-2016-03584.3IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was n CVE-2016-03596.1CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, a CVE-2016-03609.8IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow CVE-2016-03616.5IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with CVE-2016-03627.7IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to conduct CVE-2016-03638.1The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.CVE-2016-03644.3IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation CVE-2016-03655.9IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is CVE-2016-03663.7IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive informa