rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-5996 
The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 does not enforce password-length restrictions, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T01:00:00.000Z
CVE-2016-5997 
The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 does not apply password-quality rules to password changes, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T01:00:00.000Z
CVE-2016-6000 
IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: TRIRIGA Application Platform
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6001 
IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Forms Experience Builder
Published: 2017-02-01T22:00:00.000Z
CVE-2016-6018 
IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain additional information to conduct further attacks. IBM X-Force ID: 116738.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Contract Management
Published: 2017-07-19T20:00:00.000Z
CVE-2016-6019 
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116739.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-07-13T15:00:00.000Z
CVE-2016-6020 
IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Sterling B2B Integrator
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6021 
IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116755.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-08-14T22:00:00.000Z
CVE-2016-6022 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-6023 
Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T10:00:00.000Z
CVE-2016-6024 
IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages. IBM X-Force ID: 116868.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2017-11-27T21:00:00.000Z
CVE-2016-6025 
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to obtain access by leveraging an unattended workstation to conduct a post-logoff session-reuse attack involving a modified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T10:00:00.000Z
CVE-2016-6026 
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T10:00:00.000Z
CVE-2016-6027 
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T10:00:00.000Z
CVE-2016-6028 
IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6029 
IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 116881.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-08-14T22:00:00.000Z
CVE-2016-6030 
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6031 
IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-6032 
IBM Rational Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-08T19:00:00.000Z
CVE-2016-6033 
IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1995545.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager for Virtual Environments
Published: 2017-02-15T19:00:00.000Z
CVE-2016-6034 
IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager for Virtual Environments
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6035 
IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116896.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-05-10T14:00:00.000Z
CVE-2016-6036 
IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-6037 
IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains malicious HTML code, which when the project is viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 116918.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-05-10T14:00:00.000Z
CVE-2016-6038 
Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.3, 6.1, and 7.1, allows remote authenticated users to read arbitrary files via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T17:00:00.000Z
CVE-2016-6039 
IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6040 
IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced.
Problem types: description: Bypass Security
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6042 
IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: AppScan Enterprise
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6043 
Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.
Problem types: description: Bypass Security
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager Extended Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6044 
IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager Extended Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6045 
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager Extended Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6046 
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager Extended Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6047 
IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6054 
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6055 
IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1995515.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational DOORS Next Generation
Published: 2017-02-23T16:00:00.000Z
CVE-2016-6056 
IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000442.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Call Center for Commerce
Published: 2017-03-27T22:00:00.000Z
CVE-2016-6059 
IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: InfoSphere Information Server
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6060 
An undisclosed vulnerability in IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 could allow a JazzGuest user to see project names. IBM Reference #: 1995547.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational DOORS Next Generation
Published: 2017-02-15T19:00:00.000Z
CVE-2016-6061 
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6062 
IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference#: 213457065.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Resilient
Published: 2017-02-16T20:00:00.000Z
CVE-2016-6065 
IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Guardium
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6068 
IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-02-01T22:00:00.000Z
CVE-2016-6072 
IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Maximo Asset Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6077 
IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document. IBM Reference #: 1991584.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Cognos Disclosure Management
Published: 2017-02-15T19:00:00.000Z
CVE-2016-6079 
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs: IV88658, IV87981, IV88419, IV87640, IV88053.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: AIX
Published: 2017-02-15T19:00:00.000Z
CVE-2016-6080 
The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: WebSphere Message Broker
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6082 
IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: BigFix Platform
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6083 
IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID: 117696.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Tivoli Monitoring V6
Published: 2017-06-27T16:00:00.000Z
CVE-2016-6084 
IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: BigFix Platform
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6085 
IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: BigFix Platform
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6087 
IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Domino
Published: 2017-06-07T17:00:00.000Z
CVE-2016-6089 
IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: MQ
Published: 2017-06-07T17:00:00.000Z
CVE-2016-6090 
IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and potentially causing a denial of service.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: WebSphere Commerce Enterprise
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6092 
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-07T16:00:00.000Z
CVE-2016-6093 
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2017-06-08T21:00:00.000Z
CVE-2016-6094 
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-07T16:00:00.000Z
CVE-2016-6095 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-02T22:00:00.000Z
CVE-2016-6096 
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-07T16:00:00.000Z
CVE-2016-6097 
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-07T16:00:00.000Z
CVE-2016-6098 
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2017-06-08T21:00:00.000Z