rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-1326 
IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2017-06-22T18:00:00.000Z
CVE-2017-1327 
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: iNotes
Published: 2017-08-03T15:00:00.000Z
CVE-2017-1328 
IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy. By crafting a suitable request, an attacker could exploit this vulnerability to bypass security and use the vulnerable API. IBM X-Force ID: 126230.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: API Connect
Published: 2017-06-27T16:00:00.000Z
CVE-2017-1329 
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 126231.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-07-06T14:00:00.000Z
CVE-2017-1331 
IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Content Navigator
Published: 2017-08-04T16:00:00.000Z
CVE-2017-1332 
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: iNotes
Published: 2017-07-31T21:00:00.000Z
CVE-2017-1333 
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future attacks against the system. IBM X-Force ID: 126241.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: OpenPages GRC Platform
Published: 2017-11-01T21:00:00.000Z
CVE-2017-1334 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126242.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1335 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126243.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1336 
IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files. IBM X-Force ID: 126244.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: BigInsights
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1337 
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ
Published: 2017-07-10T16:00:00.000Z
CVE-2017-1338 
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126246.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational DOORS Next Generation
Published: 2017-08-18T15:00:00.000Z
CVE-2017-1339 
IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or administrator password which can result in information disclosure or a denial of service. IBM X-Force ID: 126247.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect
Published: 2017-10-05T17:00:00.000Z
CVE-2017-1340 
IBM Jazz Reporting Service (JRS) 6.0.4 could allow an authenticated user to obtain information on another server that the current report builder interacts with. IBM X-Force ID: 126455.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2017-11-01T21:00:00.000Z
CVE-2017-1341 
IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been denied access. IBM X-Force ID: 126456.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: MQ
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1342 
IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Insights Foundation for Energy
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1345 
IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126460.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Insights Foundation for Energy
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1346 
IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T16:00:00.000Z
CVE-2017-1347 
IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126462.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2017-06-23T16:00:00.000Z
CVE-2017-1348 
IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126524.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2017-06-23T16:00:00.000Z
CVE-2017-1349 
IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID: 126525.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2017-06-23T16:00:00.000Z
CVE-2017-1350 
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to improper access controls. IBM X-Force ID: 126526.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2018-06-05T15:00:00.000Z
CVE-2017-1352 
IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2017-09-12T21:00:00.000Z
CVE-2017-1353 
IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Atlas eDiscovery Process Management
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1354 
IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126681.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Atlas eDiscovery Process Management
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1355 
IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Atlas eDiscovery Process Management
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1356 
IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Atlas eDiscovery Process Management
Published: 2017-12-07T15:00:00.000Z
CVE-2017-1357 
IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2017-08-09T18:00:00.000Z
CVE-2017-1359 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126686.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1362 
IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2017-09-25T16:00:00.000Z
CVE-2017-1363 
IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126856.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-25T12:00:00.000Z
CVE-2017-1364 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126857.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1365 
IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 126858.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2017-12-27T16:00:00.000Z
CVE-2017-1366 
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-08-06T14:00:00.000Z
CVE-2017-1367 
IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126860.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-07-13T16:00:00.000Z
CVE-2017-1368 
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-08-06T14:00:00.000Z
CVE-2017-1369 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126862.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-10-02T20:00:00.000Z
CVE-2017-1370 
IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2017-07-31T21:00:00.000Z
CVE-2017-1371 
Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to. IBM X-Force ID: 126864.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: TRIRIGA Application Platform
Published: 2017-07-21T20:00:00.000Z
CVE-2017-1372 
IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126865.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: TRIRIGA Application Platform
Published: 2017-07-21T20:00:00.000Z
CVE-2017-1373 
Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute a report they do not have access to. IBM X-Force ID: 126866.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: TRIRIGA Application Platform
Published: 2017-07-21T20:00:00.000Z
CVE-2017-1374 
Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized access to the system. IBM X-Force ID: 126867.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: TRIRIGA Application Platform
Published: 2017-07-21T20:00:00.000Z
CVE-2017-1375 
IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126868.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T21:00:00.000Z
CVE-2017-1376 
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Operations Analytics Predictive Insights
Published: 2017-08-28T20:00:00.000Z
CVE-2017-1377 
IBM Runbook Automation reveals sensitive information in error messages that could be used in further attacks against the system. IBM X-Force ID: 126874.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Runbook Automation
Published: 2017-08-10T15:00:00.000Z
CVE-2017-1378 
IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect for Virtual Environments
Published: 2017-10-05T17:00:00.000Z
CVE-2017-1379 
IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-Force ID: 127002.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2017-06-15T13:00:00.000Z
CVE-2017-1380 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127151.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2017-07-24T21:00:00.000Z
CVE-2017-1381 
IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2017-07-21T20:00:00.000Z
CVE-2017-1382 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom startup scripts are used. A local attacker could exploit this to gain access to files with an unknown impact. IBM X-Force ID: 127153.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2017-07-24T21:00:00.000Z
CVE-2017-1383 
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 127155.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2017-08-02T17:00:00.000Z
CVE-2017-1386 
IBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man in the middle techniques. IBM X-Force ID: 127160.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2017-07-31T21:00:00.000Z
CVE-2017-1395 
IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 127341.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-07-13T16:00:00.000Z
CVE-2017-1396 
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-08-06T14:00:00.000Z
CVE-2017-1398 
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Commerce Enterprise
Published: 2017-07-10T16:00:00.000Z
CVE-2017-1405 
IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 127392.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2018-06-08T13:00:00.000Z
CVE-2017-1407 
IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 127394.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2017-09-27T17:00:00.000Z
CVE-2017-1409 
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2018-08-06T14:00:00.000Z