CVE-2016-3038

IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114614.

• CWE-79

• http://www.ibm.com/support/docview.wss?uid=swg21999649Patch, Vendor Advisory
• http://www.securityfocus.com/bid/97915Third Party Advisory, VDB Entry
• http://www.ibm.com/support/docview.wss?uid=swg21999649Patch, Vendor Advisory
• http://www.securityfocus.com/bid/97915Third Party Advisory, VDB Entry

Published

Apr 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3032IBM Cognos Analytics 11.0 is vulnerable to cross-site script…
• CVE-2016-3033IBM AppScan Source 8.7 through 9.0.3.3 allows remote authent…
• CVE-2016-3034IBM AppScan Source uses a one-way hash without salt to encry…
• CVE-2016-3035IBM AppScan Source could reveal some sensitive information t…
• CVE-2016-3036IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of se…
• CVE-2016-3037IBM Cognos TM1 10.1 and 10.2 provides a service to return th…
• CVE-2016-3039IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authe…
• CVE-2016-3040IBM WebSphere Application Server (WAS) Liberty, as used in I…
• CVE-2016-3042Cross-site scripting (XSS) vulnerability in the Web UI in IB…
• CVE-2016-3043IBM Security Access Manager for Web could allow a remote att…
• CVE-2016-3044The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.…
• CVE-2016-3045IBM Security Access Manager for Web stores sensitive informa…