rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1846 
IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150945.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2018-11-02T15:00:00.000Z
CVE-2018-1847 
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 150946.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2019-09-18T15:10:12.000Z
CVE-2018-1848 
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2018-12-14T15:30:00.000Z
CVE-2018-1850 
IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Access Manager Appliance
Published: 2018-10-22T13:00:00.000Z
CVE-2018-1851 
IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-10-31T13:00:00.000Z
CVE-2018-1853 
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 151014.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Protect
Published: 2019-04-08T14:50:37.755Z
CVE-2018-1857 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data they shouldn't be able to see. IBM X-Force ID: 151155.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2018-11-09T00:00:00.000Z
CVE-2018-1858 
IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-06-25T15:45:29.658Z
CVE-2018-1859 
IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges. IBM X-Force ID: 151258.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: API Connect
Published: 2019-01-04T15:00:00.000Z
CVE-2018-1871 
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 151329.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-12-06T14:00:00.000Z
CVE-2018-1872 
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 151330.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-11-09T17:00:00.000Z
CVE-2018-1874 
IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. IBM X-Force ID: 151636.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-04-02T13:20:33.838Z
CVE-2018-1875 
IBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 151639.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Governance Catalog
vendor: IBM
product: InfoSphere Information Server on Cloud
Published: 2019-03-05T18:00:00.000Z
CVE-2018-1876 
IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X-Force ID: 151707.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2018-11-02T15:00:00.000Z
CVE-2018-1877 
IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be available to a local user. IBM X-Force ID: 151713.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2018-11-02T15:00:00.000Z
CVE-2018-1878 
IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future attacks against the system. IBM X-Force ID: 151714.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2018-11-02T15:00:00.000Z
CVE-2018-1882 
In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client trace file. IBM X-Force ID: 151968.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect for Space Management
vendor: IBM
product: Spectrum Protect
Published: 2019-04-08T14:50:37.800Z
CVE-2018-1883 
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST API. IBM X-Force ID: 151969.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2018-12-07T16:00:00.000Z
CVE-2018-1884 
IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerable to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Case Manager
Published: 2018-11-12T16:00:00.000Z
CVE-2018-1885 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-04-08T14:50:37.845Z
CVE-2018-1886 
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 152021.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Access Manager Appliance
Published: 2018-12-13T16:00:00.000Z
CVE-2018-1887 
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 152078.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Access Manager Appliance
Published: 2018-12-13T16:00:00.000Z
CVE-2018-1888 
An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. IBM X-Force ID: 152079.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: i Access for Windows
Published: 2019-01-04T15:00:00.000Z
CVE-2018-1889 
IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2018-12-17T16:00:00.000Z
CVE-2018-1890 
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server Patterns
vendor: IBM
product: WebSphere Application Server
vendor: IBM
product: Runtimes for Java Technology
default_status: affected
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1891 
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152082.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2018-12-17T16:00:00.000Z
CVE-2018-1892 
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152156.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-06-27T13:45:29.670Z
CVE-2018-1893 
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152157.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-06-27T13:45:29.712Z
CVE-2018-1895 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152159.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-02-15T20:00:00.000Z
CVE-2018-1896 
IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Connections
Published: 2018-12-07T16:00:00.000Z
CVE-2018-1897 
IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2018-11-30T15:00:00.000Z
CVE-2018-1899 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business Glossary Anywhere due to improper access control. IBM X-Force ID: 152528.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-03-05T18:00:00.000Z
CVE-2018-1900 
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Curam Social Program Management
Published: 2018-12-11T16:00:00.000Z
CVE-2018-1901 
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-12-12T16:00:00.000Z
CVE-2018-1902 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1903 
IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Sterling Connect:Direct for UNIX
Published: 2019-04-10T14:30:27.394Z
CVE-2018-1904 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-12-11T16:00:00.000Z
CVE-2018-1905 
IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-11-26T17:00:00.000Z
CVE-2018-1906 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM X-Force ID: 152663.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-04-02T13:20:33.880Z
CVE-2018-1908 
IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152671.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1910 
IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152734.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1911 
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152735.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
Published: 2019-03-06T20:00:00.000Z
CVE-2018-1912 
IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152736.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
Published: 2019-03-06T20:00:00.000Z
CVE-2018-1913 
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152737.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
Published: 2019-04-03T13:50:29.570Z
CVE-2018-1914 
IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152738.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1916 
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152740.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-03-14T23:00:00.000Z
CVE-2018-1917 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID: 152784.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-04-02T13:20:33.925Z
CVE-2018-1918 
IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152785.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2019-01-08T17:00:00.000Z
CVE-2018-1920 
IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152855.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Marketing Platform
Published: 2018-12-07T16:00:00.000Z
CVE-2018-1921 
IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152857.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Campaign
Published: 2019-07-17T14:05:20.754Z
CVE-2018-1922 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152858.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1923 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152859.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-03-11T22:00:00.000Z
CVE-2018-1925 
IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ
Published: 2019-04-15T14:55:26.446Z
CVE-2018-1926 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-12-12T16:00:00.000Z
CVE-2018-1927 
IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: StoredIQ
Published: 2018-11-30T15:00:00.000Z
CVE-2018-1928 
IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: StoredIQ
Published: 2018-11-30T15:00:00.000Z