CVE-2016-9972

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 120208.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
IBM	Security QRadar SIEM	7.2; 7.3

References

http://www.ibm.com/support/docview.wss?uid=swg22004925Patch, Vendor Advisory
http://www.securityfocus.com/bid/99268Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/120208Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22004925Patch, Vendor Advisory
http://www.securityfocus.com/bid/99268Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/120208Vendor Advisory

Timeline

Published: Jun 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99735.4IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI CVE-2016-99758.8IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malic CVE-2016-99768.4IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a speci CVE-2016-99778.8IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate CVE-2016-99784.3IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force I CVE-2016-99795.4IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr CVE-2016-99805.4IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr CVE-2016-99818.1IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM CVE-2016-99826.5IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information such as account lists due CVE-2016-99835.3IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should no CVE-2016-99848.8IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administr CVE-2016-99855.5IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999