IBM Sametime vulnerabilities

46 CVEs affecting IBM Sametime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-3331, published 2018-02-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3982, published 2014-05-26. Medium severity, CVSS 5.0. EPSS: 13.2% chance of exploitation in the next 30 days. The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to obtain unspecified installation information and technical data via a request to a public page.
CVE-2013-3975, published 2014-05-26. Medium severity, CVSS 5.0. EPSS: 13.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to discover user names, full names, and e-mail addresses via a…
CVE-2013-3977, published 2014-05-26. Medium severity, CVSS 4.3. EPSS: 9% chance of exploitation in the next 30 days. The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names.
CVE-2014-3867, published 2014-05-26. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote…
CVE-2014-4748, published 2014-07-26. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2012-3308, published 2012-08-17. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Sametime 8.0.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via an IM chat.
CVE-2013-3980, published 2014-05-26. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to cause a denial of service (room unusability) by generating a large number of fictitious users…
CVE-2012-3331, published 2018-02-08. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. IBM X-Force ID: 78048.
CVE-2013-6727, published 2014-01-31. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via…
CVE-2013-3981, published 2014-05-26. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors.

Latest

CVE-2016-2980, published 2017-08-29. Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days. The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM…
CVE-2016-2978, published 2017-08-29. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID: 113938.
CVE-2016-2976, published 2017-08-29. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report history. IBM X-Force ID: 113936.
CVE-2016-2975, published 2017-08-29. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2016-2974, published 2017-08-29. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as other users on the…
CVE-2016-2967, published 2017-08-29. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality…
CVE-2016-2966, published 2017-08-29. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847.
CVE-2016-2964, published 2017-08-29. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM X-Force ID: 113813.
CVE-2016-0358, published 2017-08-29. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM X-Force ID: 111928.