CVE-2016-9738

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
IBM	Security QRadar SIEM	7.2; 7.3

References

http://www.ibm.com/support/docview.wss?uid=swg22004926Patch, Vendor Advisory
http://www.securityfocus.com/bid/99266Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/119783Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22004926Patch, Vendor Advisory
http://www.securityfocus.com/bid/99266Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/119783Vendor Advisory

Timeline

Published: Jun 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-97397.8IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.CVE-2016-97407.5IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of re CVE-2016-97465.4IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2016-97475.4IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W CVE-2016-97484.3IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further att CVE-2016-97493.3IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack CVE-2016-97506.5IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207.CVE-2016-97516.1Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web scr CVE-2016-97528.6In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redir CVE-2016-97547.8The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain CVE-2016-97557.8The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (in CVE-2016-97565.5arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows