PT-2017-8286

Name of the Vulnerable Software and Affected Versions IBM Sametime Meeting Server versions 8.5.2 through 9.0 Description The issue allows a malicious user to lower other users' hands in a meeting, potentially disrupting the meeting process. Recommendations For versions 8.5.2 through 9.0, at the...

PT-2017-8280

Name of the Vulnerable Software and Affected Versions IBM Sametime Media Services versions 8.5.2 through 9.0 Description The issue allows sensitive information to be disclosed in stack trace error logs, potentially aiding an attacker in future attacks. Recommendations For versions 8.5.2 through...

PT-2017-7901

Name of the Vulnerable Software and Affected Versions IBM Sametime Meeting Server versions 8.5.2 through 9.0 Description The issue allows an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. Recommendations...

CVE-2016-2980: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993...

CVE-2016-2965: Cross-Site Request Forgery (CSRF)

IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious link, a remote attacker could force the user to log out of Sametime. IBM X-Force ID: 113846...

CVE-2016-0354: Unrestricted Upload of File with Dangerous Type

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893...

CVE-2016-2976: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report history. IBM X-Force ID: 113936...

CVE-2016-2975: Improper Neutralization of Input During Web Page Generation

IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113935...

CVE-2016-2974: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as other users on the local machine of the user. IBM X-Force ID: 113934...

CVE-2016-2967: Improper Neutralization of Input During Web Page Generation

IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113848...

CVE-2016-2973: Improper Neutralization of Input During Web Page Generation

IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113899...

CVE-2016-2972: Undefined Security Weakness

IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by a local user. IBM X-Force ID: 113855...

CVE-2016-2969: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850...

CVE-2016-10503: Improper Input Validation

IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803...

CVE-2016-0356: Cross-Site Request Forgery (CSRF)

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895...

CVE-2016-2978: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID: 113938...

CVE-2016-2966: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847...

CVE-2016-2971: Exposure of Sensitive Information to an Unauthorized Actor

IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Force ID: 113898...

CVE-2016-2959: Undefined Security Weakness

IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804...

PT-2017-8289

Name of the Vulnerable Software and Affected Versions Sametime WebPlayer versions 8.5.2 through 9.0 Description The issue allows a malicious site to inject its own script by exploiting a weakness in the way the WebPlayer functions. Recommendations For versions 8.5.2 through 9.0, consider disablin...