CVE-2016-0304

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-29 · updated 2026-06-17
Weakness: CWE-284

Description

The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.

Affected products

IBM Corporation Domino: 8.5.3, 8.5.3.1, 8.5.3.2, 8.5.3.3, 8.5.3.4, 8.5.3.5 (+19)

References

http://www-01.ibm.com/support/docview.wss?uid=swg21983328
http://www-01.ibm.com/support/docview.wss?uid=swg21983328

Get alerted when CVE-2016-0304 or the next vulnerability affects your stack