CVE-2016-2972

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by a local user. IBM X-Force ID: 113855.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
IBM	Sametime	8.5.2; 8.5.2.1; 9.0; 9.0.0.1; 9.0.1

References

http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/113855VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/113855VDB Entry, Vendor Advisory

Timeline

Published: Aug 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-29735.4IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri CVE-2016-29743.3IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to CVE-2016-29755.4IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2016-29764.3IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the me CVE-2016-29774.3IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937.CVE-2016-29783.3IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local u CVE-2016-29795.4IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri CVE-2016-29806.3The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a CVE-2016-29816.8An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Referenc CVE-2016-29838.1IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TL CVE-2016-29847.0IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x b CVE-2016-29857.0IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x b