CVE-2016-0370

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.

Metrics

CVSS 3.0 2.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21988726Patch, Vendor Advisory
http://www.securityfocus.com/bid/92471
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21988726Patch, Vendor Advisory
http://www.securityfocus.com/bid/92471

Timeline

Published: Sep 1, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-03715.5The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.CVE-2016-03723.7IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 CVE-2016-03734.3IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not prope CVE-2016-03748.8The builder tools in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authentica CVE-2016-03758.8JMS Client in IBM MessageSight 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to CVE-2016-03768.1The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.CVE-2016-03774.3The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 m CVE-2016-03783.7IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to CVE-2016-03793.1IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a den CVE-2016-03803.3IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, wh CVE-2016-03814.3IBM Cognos TM1 10.2.2 before FP5, when the host/pmhub/pm/admin AdminGroups setting is empty, allows remote authenticated users to cause a de CVE-2016-03824.0The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captur