rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1929 
IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1932 
IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-01-08T17:00:00.000Z
CVE-2018-1933 
IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics
Published: 2019-05-01T15:15:20.882Z
CVE-2018-1934 
IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Business Intelligence
Published: 2019-12-20T16:25:24.653Z
CVE-2018-1935 
IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Connections
Published: 2018-12-06T14:00:00.000Z
CVE-2018-1936 
IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 153316.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2
vendor: IBM
product: Db2
Published: 2019-04-03T13:50:29.611Z
CVE-2018-1937 
IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153317.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-03-05T18:00:00.000Z
CVE-2018-1938 
IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153318.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-03-05T18:00:00.000Z
CVE-2018-1939 
IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 153319.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-03-05T18:00:00.000Z
CVE-2018-1941 
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Campaign
Published: 2018-12-05T17:00:00.000Z
CVE-2018-1943 
IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 153385.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-04-08T14:50:37.897Z
CVE-2018-1944 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1945 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1946 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1947 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1948 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1949 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1950 
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2019-02-21T17:00:00.000Z
CVE-2018-1951 
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153494.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Publishing Engine
Published: 2019-01-04T15:00:00.000Z
CVE-2018-1952 
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153495.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1956 
IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-01-14T14:00:00.000Z
CVE-2018-1957 
IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1959 
IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153633.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-01-24T17:00:00.000Z
CVE-2018-1961 
IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Contract Management
Published: 2019-04-29T16:35:17.556Z
CVE-2018-1962 
IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-02-04T21:00:00.000Z
CVE-2018-1967 
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153748.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-01-14T14:00:00.000Z
CVE-2018-1968 
IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-07-11T19:55:18.576Z
CVE-2018-1969 
IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-01-14T14:00:00.000Z
CVE-2018-1970 
IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2019-02-04T21:00:00.000Z
CVE-2018-1973 
IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality. IBM X-Force ID: 153914.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: API Connect
Published: 2018-12-20T14:00:00.000Z
CVE-2018-1974 
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1975 
IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Web Access
Published: 2019-05-16T14:50:14.195Z
CVE-2018-1976 
IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-01-29T16:00:00.000Z
CVE-2018-1977 
IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2018-12-14T15:30:00.000Z
CVE-2018-1978 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154069.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1980 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1982 
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154135.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1983 
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154136.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1984 
IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154137.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1985 
IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic. IBM X-Force ID: 154207.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Trusteer Rapport
vendor: IBM
product: Security Rapport for MacOS
Published: 2020-08-24T15:30:29.323Z
CVE-2018-1987 
IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect for Enterprise Resource Planning
Published: 2019-08-02T14:10:12.747Z
CVE-2018-1990 
IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud App Management
Published: 2019-05-10T14:40:19.958Z
CVE-2018-1991 
IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-05-22T14:45:18.466Z
CVE-2018-1992 
The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Power 9 Systems
Published: 2019-03-21T14:35:28.145Z
CVE-2018-1993 
IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2019-01-08T17:00:00.000Z
CVE-2018-1994 
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 154494.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-04-10T14:30:27.474Z
CVE-2018-1996 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-02-19T17:00:00.000Z
CVE-2018-1997 
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-04-08T14:50:37.952Z
CVE-2018-1998 
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1999 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-04-08T14:50:37.999Z
CVE-2018-20000 
Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T02:00:00.000Z
CVE-2018-20001 
In Libav 12.3, there is a floating point exception in the range_decode_culshift function (called from range_decode_bits) in libavcodec/apedec.c that will lead to remote denial of service via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T02:00:00.000Z
CVE-2018-20002 
The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T02:00:00.000Z
CVE-2018-20004 
An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T06:00:00.000Z
CVE-2018-20005 
An issue has been found in Mini-XML (aka mxml) 2.12. It is a use-after-free in mxmlWalkNext in mxml-search.c, as demonstrated by mxmldoc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T06:00:00.000Z
CVE-2018-20006 
An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save (reachable via the index.php?id=book URI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T06:00:00.000Z
CVE-2018-20007 
Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T18:08:34.000Z
CVE-2018-20008 
iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain text) and the web-console password (base64) via the debugging console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-28T20:03:27.000Z