{"api_version":"1","generated_at":"2026-07-23T09:07:55+00:00","cve":"CVE-2016-5935","urls":{"html":"https://cve.report/CVE-2016-5935","api":"https://cve.report/api/cve/CVE-2016-5935.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5935","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5935"},"summary":{"title":"CVE-2016-5935","description":"IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.","state":"PUBLISHED","assigner":"ibm","published_at":"2017-02-02 22:59:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","Obtain Information"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.ibm.com/support/docview.wss?uid=swg21997711","name":"http://www.ibm.com/support/docview.wss?uid=swg21997711","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Security Bulletin: Information disclosure CVE-2016-5935 affects IBM Dashboard Application Services Hub (DASH) v3.1.3 - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/96003","name":"http://www.securityfocus.com/bid/96003","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM Jazz for Service Management CVE-2016-5935 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5935","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5935","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.0.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.0.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.0.3","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 2.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 2.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.2.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 2.1.1.0","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 2.1.1.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Tivoli Components","version":"affected 1.1.3","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5935","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"dashboard_application_services_hub","cpe6":"3.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5935","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"jazz_for_service_management","cpe6":"1.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:15:10.036Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"96003","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/96003"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21997711"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Tivoli Components","vendor":"IBM Corporation","versions":[{"status":"affected","version":"1.1"},{"status":"affected","version":"1.1.0.1"},{"status":"affected","version":"1.1.0.2"},{"status":"affected","version":"1.1.0.3"},{"status":"affected","version":"2.1"},{"status":"affected","version":"2.2"},{"status":"affected","version":"1.1.1"},{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.2.1"},{"status":"affected","version":"2.1.1.0"},{"status":"affected","version":"2.1.1.2"},{"status":"affected","version":"1.1.3"}]}],"datePublic":"2017-01-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-02-06T10:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"96003","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/96003"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21997711"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2016-5935","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Tivoli Components","version":{"version_data":[{"version_value":"1.1"},{"version_value":"1.1.0.1"},{"version_value":"1.1.0.2"},{"version_value":"1.1.0.3"},{"version_value":"2.1"},{"version_value":"2.2"},{"version_value":"1.1.1"},{"version_value":"1.1.2"},{"version_value":"1.1.2.1"},{"version_value":"2.1.1.0"},{"version_value":"2.1.1.2"},{"version_value":"1.1.3"}]}}]},"vendor_name":"IBM Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"96003","refsource":"BID","url":"http://www.securityfocus.com/bid/96003"},{"name":"http://www.ibm.com/support/docview.wss?uid=swg21997711","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21997711"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2016-5935","datePublished":"2017-02-02T22:00:00.000Z","dateReserved":"2016-06-29T00:00:00.000Z","dateUpdated":"2024-08-06T01:15:10.036Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-02 22:59:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","Obtain Information"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:dashboard_application_services_hub:3.1.3:*:*:*:*:*:*:*","matchCriteriaId":"C16FFACB-4BCC-4835-9961-137A704199BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ibm:jazz_for_service_management:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"A4D61491-0785-4193-A828-2177AFB81380"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5935","Ordinal":"1","Title":"CVE-2016-5935","CVE":"CVE-2016-5935","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5935","Ordinal":"1","NoteData":"IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.","Type":"Description","Title":"CVE-2016-5935"},{"CveYear":"2016","CveId":"5935","Ordinal":"2","NoteData":"2017-02-02","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5935","Ordinal":"3","NoteData":"2017-02-06","Type":"Other","Title":"Modified"}]}}}