Low severity · published Sep 1, 2016
CVE-2016-0370
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via…
2.7
CVSS
0.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Forms Experience Builder · Ibm
8.5.0.0; 8.5.1.0; 8.5.1.1; 8.6.0.0; 8.6.1; 8.6.1.1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0370
Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21988726
www.securityfocus.com
http://www.securityfocus.com/bid/92471
More from Forms Experience Builder
8.0
CVE-2016-2884
Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote…
5.4
CVE-2014-6169
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
3.1
CVE-2016-6001
IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of…
2.7
CVE-2016-0369
XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data