rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1347 NetIQ iManager, versions prior to 3.1,  reflected XSS issue
The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
Problem types: description: Reflected XSS
Affected products: vendor: NetIQ
product: iManager
Published: 2018-03-21T14:00:00.000Z
CVE-2018-1348 NetIQ Identity Manager SSL Renegotiation
NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack.
Problem types: description: NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack.
Affected products: vendor: NetIQ
product: Identity Manager
Published: 2018-03-26T19:00:00.000Z
CVE-2018-1349 NetIQ Identity Manager Driver Component Log File Information Leakage
The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration.
Problem types: description: The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration.
Affected products: vendor: NetIQ
product: Identity Manager
Published: 2018-03-26T19:00:00.000Z
CVE-2018-1350 NetIQ Identity Manager Driver Component Information Leakage
The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration.
Problem types: description: The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration.
Affected products: vendor: NetIQ
product: Identity Manager
Published: 2018-03-26T19:00:00.000Z
CVE-2018-1351 
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI config installation log.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiManager
Published: 2018-06-28T15:00:00.000Z
CVE-2018-1352 
A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-08T18:00:00.000Z
CVE-2018-1353 
An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms unrelated to the assigned adom.
Problem types: description: Improper Access Control
Affected products: vendor: Fortinet, Inc.
product: FortiManager
Published: 2018-09-05T13:00:00.000Z
CVE-2018-1354 
An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the avatar picture of other users with arbitrary content.
Problem types: description: Improper Access Control
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiManager, FortiAnalyzer
Published: 2018-06-27T20:00:00.000Z
CVE-2018-1355 
An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature.  An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiManager, FortiAnalyzer
Published: 2018-06-27T20:00:00.000Z
CVE-2018-1356 
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
Published: 2019-04-09T20:55:00.000Z
CVE-2018-1360 
A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiManager
Published: 2019-04-25T17:08:07.000Z
CVE-2018-1361 
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137158.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-01-11T17:00:00.000Z
CVE-2018-1362 
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cram Social Program Management
Published: 2018-01-19T14:00:00.000Z
CVE-2018-1363 
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137448.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2018-04-25T13:00:00.000Z
CVE-2018-1364 
IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Content Navigator
Published: 2018-01-29T16:00:00.000Z
CVE-2018-1366 
IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. An attacker could exploit this vulnerability to exploit other vulnerabilities in spreadsheet software. IBM X-Force ID: 137452.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Content Navigator
Published: 2018-02-07T17:00:00.000Z
CVE-2018-1368 
IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM X-Force ID: 137765.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2018-02-09T17:00:00.000Z
CVE-2018-1369 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-05-29T13:00:00.000Z
CVE-2018-1370 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-05-29T13:00:00.000Z
CVE-2018-1371 
An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. IBM X-Force ID: 137771.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2018-04-17T15:00:00.000Z
CVE-2018-1372 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 137772.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-02-27T17:00:00.000Z
CVE-2018-1373 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-03-02T17:00:00.000Z
CVE-2018-1374 
An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) client connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa. IBM X-Force ID: 137775.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: WebSphere MQ
Published: 2018-06-26T20:00:00.000Z
CVE-2018-1375 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-05-29T13:00:00.000Z
CVE-2018-1376 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137777.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-05-29T13:00:00.000Z
CVE-2018-1377 
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2018-02-26T14:00:00.000Z
CVE-2018-1380 
IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their ca-id to another users and read sensitive information. IBM X-Force ID: 138077.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Master Data Management Collaboration Server
Published: 2018-10-29T15:00:00.000Z
CVE-2018-1382 
IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138079.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: API Connect
Published: 2018-02-07T17:00:00.000Z
CVE-2018-1383 
A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain root access on another machine. IBM X-force ID: 138117.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: AIX
Published: 2018-02-13T20:00:00.000Z
CVE-2018-1384 
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Process Manager
Published: 2018-03-30T16:00:00.000Z
CVE-2018-1386 
IBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4) contains directories with improper permissions that could allow a local user to with special access to gain root privileges. IBM X-Force ID: 138208.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Workload Scheduler
Published: 2018-03-14T00:00:00.000Z
CVE-2018-1387 
IBM Application Performance Management for Monitoring & Diagnostics (IBM Monitoring 8.1.3 and 8.1.4) may release sensitive personal data to the staff who can access to the database of this product. IBM X-Force ID: 138210.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Monitoring
Published: 2018-03-08T16:00:00.000Z
CVE-2018-1388 
GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force ID: 138212.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere MQ
Published: 2018-02-07T17:00:00.000Z
CVE-2018-1389 
IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: API Connect
Published: 2018-04-30T14:00:00.000Z
CVE-2018-1390 
IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138221.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-03-30T16:00:00.000Z
CVE-2018-1391 
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could cause a denial of service. IBM X-Force ID: 138376.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-02-22T19:00:00.000Z
CVE-2018-1392 
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. IBM X-Force ID: 138377.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-02-22T19:00:00.000Z
CVE-2018-1393 
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. IBM X-Force ID: 138378.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-06-13T14:00:00.000Z
CVE-2018-1394 
Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138425.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Software Architect Design Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
Published: 2018-08-20T21:00:00.000Z
CVE-2018-1395 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138427.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1396 
IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138429.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-07-10T16:00:00.000Z
CVE-2018-1398 
IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote attacker to download certain files that could contain sensitive information. IBM X-Force ID: 138434.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2018-07-20T16:00:00.000Z
CVE-2018-1399 
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138435.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Daeja ViewONE
Published: 2018-02-27T17:00:00.000Z
CVE-2018-1401 
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138437.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-02-09T17:00:00.000Z
CVE-2018-1403 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138439.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1404 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138440.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1405 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138441.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1407 
IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138445.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2018-07-10T15:00:00.000Z
CVE-2018-1408 
IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138446.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2018-07-10T15:00:00.000Z
CVE-2018-1409 
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Client Application Access
vendor: IBM
product: Notes
Published: 2018-02-19T14:00:00.000Z
CVE-2018-1410 
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138709.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Client Application Access
vendor: IBM
product: Notes
Published: 2018-02-19T14:00:00.000Z
CVE-2018-1411 
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138710.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Client Application Access
vendor: IBM
product: Notes
Published: 2018-02-19T14:00:00.000Z
CVE-2018-1413 
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138819.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2018-05-07T13:00:00.000Z
CVE-2018-1414 
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 138820.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-02-22T19:00:00.000Z
CVE-2018-1415 
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138821.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-02-22T19:00:00.000Z
CVE-2018-1416 
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138822.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-02-27T17:00:00.000Z