CVE-2016-3039

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-30406.8IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0 CVE-2016-30425.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authe CVE-2016-30435.9IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable CVE-2016-30446.5The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of servic CVE-2016-30453.7IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized CVE-2016-30462.7IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which coul CVE-2016-30476.8Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arb CVE-2016-30485.4IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS CVE-2016-30495.4IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when CVE-2016-30514.3IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-For CVE-2016-30525.9Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted CVE-2016-30537.8IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.