CVE-2016-2953

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.

Metrics

CVSS 3.0 3.7/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1LO90268Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90295Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990888Patch, Vendor Advisory
http://www.securityfocus.com/bid/94415Third Party Advisory, VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90268Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90295Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990888Patch, Vendor Advisory
http://www.securityfocus.com/bid/94415Third Party Advisory, VDB Entry

Timeline

Published: Nov 30, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-29545.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated user CVE-2016-29555.4Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject ar CVE-2016-29565.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated user CVE-2016-29574.3IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by re CVE-2016-29584.3IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by re CVE-2016-29594.3IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 1138 CVE-2016-29603.7IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty b CVE-2016-29615.3The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows r CVE-2016-29638.8Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authenticati CVE-2016-29645.3IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about th CVE-2016-29656.5IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input.CVE-2016-29664.3IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113