CVE-2014-0890 — IBM Sametime vulnerability

CWE-25515 documents4 sources
Severity
1.9LOWNVD
EPSS
0.1%
top 84.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Sametime
Timeline
PublishedMar 6
Latest updateMay 17

Description

The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony.*.level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by reading a log file.

CVSS vector

AV:L/AC:M/C:P/I:N/A:NExploitability: 3.4 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/sametime7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-4c45-3482-x925: The Connect client in IBM Sametime 8↗2022-05-17
▶
CVEList
CVE-2014-0890: The Connect client in IBM Sametime 8↗2014-03-06
▶

💬Community

8
Bugzilla
CVE-2014-4216 OpenJDK: Incorrect generic signature attribute parsing (Hotspot, 8037076)↗2014-07-15
▶
Bugzilla
CVE-2014-4223 OpenJDK: Incorrect handling of invocations with exhausted ranks (Libraries, 8035793)↗2014-07-15
▶
Bugzilla
CVE-2014-2483 OpenJDK: Restrict use of privileged annotations (Libraries, 8034985)↗2014-07-15
▶
Bugzilla
CVE-2014-4219 OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119)↗2014-07-15
▶
Bugzilla
CVE-2014-2490 OpenJDK: Event logger format string vulnerability (Hotspot, 8037076)↗2014-07-15
▶
CVE-2014-0890 — IBM Sametime vulnerability | cvebase