rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9694 
IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999960.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Rhapsody Design Manager
Published: 2017-03-20T16:00:00.000Z
CVE-2016-9696 
IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM Reference #: 1999960.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Rational Rhapsody Design Manager
Published: 2017-03-20T16:00:00.000Z
CVE-2016-9697 
An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference #: 1999960.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Rhapsody Design Manager
Published: 2017-03-20T16:00:00.000Z
CVE-2016-9698 
IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999960.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2017-06-08T21:00:00.000Z
CVE-2016-9700 
IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2017-07-05T18:00:00.000Z
CVE-2016-9701 
IBM Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119529.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2017-07-05T17:00:00.000Z
CVE-2016-9703 
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Identity Manager
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9704 
IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Identity Manager
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9706 
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Integration Bus
Published: 2017-02-15T19:00:00.000Z
CVE-2016-9707 
IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000784.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-9710 
IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to obtain sensitive information. IBM X-Force ID: 119618.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Business Intelligence
Published: 2017-06-07T17:00:00.000Z
CVE-2016-9711 
IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an attacker in further attacks against the system. IBM X-Force ID: 119619.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2018-03-22T12:00:00.000Z
CVE-2016-9714 
IBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119727.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9715 
IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119728.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9716 
IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119729.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9717 
HTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploited.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9718 
IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119732.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9719 
IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 119733.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2017-07-31T21:00:00.000Z
CVE-2016-9720 
IBM QRadar 7.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM Reference #: 1999533.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9722 
IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 119737.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security QRadar SIEM
Published: 2018-01-10T17:00:00.000Z
CVE-2016-9723 
IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9724 
IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999537.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9725 
IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from external sites, avoiding the need to duplicate them. IBM Reference #: 1999539.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9726 
IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.
Problem types: description: Gain Privileges
Affected products: vendor: n/a
product: IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9727 
IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9728 
IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM Reference #: 1999543.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9729 
IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Reference #: 1999545.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9730 
IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1999549.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9731 
IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Business Process Manager Advanced
Published: 2017-02-01T20:00:00.000Z
CVE-2016-9732 
IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119761.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cram Social Program Management
Published: 2017-08-28T20:00:00.000Z
CVE-2016-9733 
IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119762.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2017-07-05T17:00:00.000Z
CVE-2016-9735 
IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781,
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-05-15T21:00:00.000Z
CVE-2016-9736 
IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2017-06-08T21:00:00.000Z
CVE-2016-9737 
IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1996200.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: TRIRIGA Application Platform
Published: 2017-03-27T22:00:00.000Z
CVE-2016-9738 
IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security QRadar SIEM
Published: 2017-06-27T16:00:00.000Z
CVE-2016-9739 
IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Identity Manager
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9740 
IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-03-07T17:00:00.000Z
CVE-2016-9746 
IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119821.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2017-07-05T17:00:00.000Z
CVE-2016-9747 
IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2017-06-22T18:00:00.000Z
CVE-2016-9748 
IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational DOORS Next Generation
Published: 2017-02-08T19:00:00.000Z
CVE-2016-9749 
IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation. IBM X-Force ID: 120206.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Campaign
Published: 2018-11-09T00:00:00.000Z
CVE-2016-9750 
IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: QRadar SIEM
Published: 2017-05-15T21:00:00.000Z
CVE-2016-9751 
Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-01T11:00:00.000Z
CVE-2016-9752 
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-01T11:00:00.000Z
CVE-2016-9754 
The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T11:00:00.000Z
CVE-2016-9755 
The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system calls, related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-28T07:42:00.000Z
CVE-2016-9756 
arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-28T07:42:00.000Z
CVE-2016-9757 
In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.
Problem types: description: Persistent XSS
Affected products: vendor: Rapid7
product: Nexpose
Published: 2016-12-20T22:00:00.000Z
CVE-2016-9772 
OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserver vice partition, or (3) certain RPC responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T17:00:00.000Z
CVE-2016-9773 
Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9556.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T18:00:00.000Z
CVE-2016-9774 
The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2016-9775 
The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2016-9776 
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-29T22:00:00.000Z
CVE-2016-9777 
KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-28T07:42:00.000Z