CVE-2016-8948

CWE-79 — Cross-site Scripting (XSS)CWE-125 — Out-of-bounds Read10 documents7 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 49.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Emptoris Sourcing
Timeline
PublishedJul 12
Latest updateMay 17

Description

IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118835.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/emptoris_sourcing7 versions+6
▶NVDibm/emptoris_sourcing11 versions+10

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-r2hv-r9qv-hmpw: IBM Emptoris Sourcing 9↗2022-05-17
▶
CVEList
CVE-2016-8948: IBM Emptoris Sourcing 9↗2017-07-12
▶
OSV
libidn vulnerabilities↗2016-08-24
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Office / COM Object - 'WMALFXGFXDSP.dll' DLL Planting (MS16-007)↗2016-01-13
▶

📋Vendor Advisories

1
Red Hat
libidn: Out-of-bounds read when reading zero byte as input↗2016-01-14
▶

💬Community

1
Bugzilla
CVE-2015-8948 libidn: Out-of-bounds read due to use of fgets with fixed-size buffer↗2016-07-22
▶
CVE-2016-8948 (MEDIUM CVSS 5.4) | IBM Emptoris Sourcing 9.5.x through | cvebase.io