← Vulnerability feed

Vulnerability record · CVE-2016-0354 · published 29 August 2017

CVE-2016-0354: Ibm sametime unrestricted file upload vulnerability

Ibm · Sametime

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.

5.5 CVSS 3.0 Medium EPSS 0.77% · top 46.2% CWE-434 · Unrestricted file upload
5.5CVSS 3.0 base score, v2 6.0
0.77%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=swg22006439 PatchVendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/111893 VDB EntryVendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006439 PatchVendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/111893 VDB EntryVendor Advisory

Track CVE-2016-0354 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2016-2972Ibm sametime vulnerabilityIBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be ac…EPSS 0.35%7.5CVE-2013-3983Ibm sametime improper input validation vulnerabilityThe Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not validate URLs in Cookie headers before using them in redire…EPSS 1.1%7.5CVE-2013-6742Ibm sametime permissions and access controls vulnerabilityThe Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 do not have an off autocomplete attribute for a password field, whic…EPSS 1.3%6.8CVE-2013-3988Ibm sametime improper input validation vulnerabilityThe Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to conduct clickjacking attacks via unspecif…EPSS 1.2%6.5CVE-2016-0355Ibm sametime cross-site request forgery vulnerabilityIBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the…EPSS 0.71%6.5CVE-2016-0356Ibm sametime cross-site request forgery vulnerabilityIBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the…EPSS 0.71%6.5CVE-2016-2965Ibm sametime cross-site request forgery vulnerabilityIBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persu…EPSS 0.80%6.3CVE-2016-2980Ibm sametime injection vulnerabilityThe Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerabi…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2016-0354), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.