CVE-2016-8961
Last modified
CVE-2016-8961 is a vulnerability of currently unknown severity. IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | License Metric Tool | 9.2.0 |
| Ibm | Bigfix Inventory | <= 9.2 |
References
- http://www.ibm.com/support/docview.wss?uid=swg21995037Vendor Advisory
- http://www.securityfocus.com/bid/95128Third Party Advisory, VDB Entry
- http://www.ibm.com/support/docview.wss?uid=swg21995037Vendor Advisory
- http://www.securityfocus.com/bid/95128Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-8961?
How severe is CVE-2016-8961?
How do I fix CVE-2016-8961?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-8950IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to …
- CVE-2016-8951IBM Emptoris Strategic Supply Management Platform 10.0.0.x t…
- CVE-2016-8952IBM Emptoris Strategic Supply Management Platform 10.0.0.x t…
- CVE-2016-8953IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a rem…
- CVE-2016-8954IBM dashDB Local uses hard-coded credentials that could allo…
- CVE-2016-8960IBM Cognos Business Intelligence 10.2 could allow a user wit…
- CVE-2016-8962IBM BigFix Inventory 9.2 does not require that users should …
- CVE-2016-8963IBM BigFix Inventory v9 stores potentially sensitive informa…
- CVE-2016-8964IBM BigFix Inventory v9 9.2 uses an inadequate account locko…
- CVE-2016-8966IBM BigFix Inventory v9 could allow a remote attacker to obt…
- CVE-2016-8967IBM BigFix Inventory v9 9.2 stores user credentials in plain…
- CVE-2016-8968IBM Jazz Foundation is vulnerable to cross-site scripting. T…
Are you affected by CVE-2016-8961?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST