{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-08-12T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21988726"}, {"name": "LO88449", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449"}, {"name": "92471", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92471"}, {"name": "LO88451", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2016-0370", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21988726", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21988726"}, {"name": "LO88449", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449"}, {"name": "92471", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92471"}, {"name": "LO88451", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-0370", "datePublished": "2016-09-01T01:00:00", "dateReserved": "2015-12-08T00:00:00", "dateUpdated": "2016-11-25T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "2F6D1D5D-6B90-406E-AE72-7DB418C9400B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "5C8D7857-0527-440C-BCE1-458E23235752", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "85DB1C93-1F16-4848-81B5-FAABED509FA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "85C2BE8B-B4F4-400A-A5D9-D984C56E0BCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "09282D37-4AB8-438F-B3E0-DB17BB0851FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.6.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5752257A-2ADE-4355-8C5A-49AE4C75F9A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "B4AD7585-4572-4EA4-A651-094549ABDEB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:forms_experience_builder:8.6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "03378236-FC68-4A5D-BF94-69C2BF6AA3CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product."}, {"lang": "es", "value": "Vulnerabilidad de XSS en IBM Forms Experience Builder 8.5.x y 8.6.x en versiones anteriores a 8.6.3 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una entrada manipulada para una aplicaci\u00f3n que fue construida con este producto."}], "id": "CVE-2016-0370", "lastModified": "2016-11-28T19:53:20.900", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-01T01:59:02.193", "references": [{"source": "psirt@us.ibm.com", "tags": ["Not Applicable"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449"}, {"source": "psirt@us.ibm.com", "tags": ["Broken Link"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21988726"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/92471"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}