CVE-2016-2944

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IV89790Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21991878Vendor Advisory
http://www.securityfocus.com/bid/94623
http://www-01.ibm.com/support/docview.wss?uid=swg1IV89790Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21991878Vendor Advisory
http://www.securityfocus.com/bid/94623

Timeline

Published: Nov 30, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-29457.5The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 CVE-2016-29467.8Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6 CVE-2016-29472.7IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quali CVE-2016-29487.8IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.CVE-2016-29493.3IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user'CVE-2016-29506.5SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands vi CVE-2016-29513.7IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to CVE-2016-29523.7IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain s CVE-2016-29533.7IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive CVE-2016-29545.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated user CVE-2016-29555.4Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject ar CVE-2016-29565.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated user