CVE-2016-0350

MEDIUM

IBM Jazz Reporting Service <5.0.2-6.0.1 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2888 and CVE-2016-0313.

References (1)

[Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg21983147

Scores

CVSS v3 5.4

EPSS 0.0017

EPSS Percentile 37.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (5)

ibm/jazz_reporting_service

Timeline

Published Jul 08, 2016

Tracked Since Feb 18, 2026