CVE-2016-3042

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI64790Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21986716Vendor Advisory
http://www.securityfocus.com/bid/92985
http://www-01.ibm.com/support/docview.wss?uid=swg1PI64790Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21986716Vendor Advisory
http://www.securityfocus.com/bid/92985

Timeline

Published: Oct 1, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-30435.9IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable CVE-2016-30446.5The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of servic CVE-2016-30453.7IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized CVE-2016-30462.7IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which coul CVE-2016-30476.8Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arb CVE-2016-30485.4IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS CVE-2016-30495.4IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when CVE-2016-30514.3IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-For CVE-2016-30525.9Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted CVE-2016-30537.8IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.CVE-2016-30545.4Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace 4.0.2 allows remote authenticated users to inject arbitrary web script or CVE-2016-30558.1IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (me