rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-4591 
IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-07-13T14:10:14.017Z
CVE-2019-4592 
IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Tivoli Monitoring
Published: 2020-02-13T15:40:21.327Z
CVE-2019-4593 
IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Qradar
vendor: IBM
product: QRadar
Published: 2020-04-15T15:13:53.712Z
CVE-2019-4594 
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID: 167810.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar
vendor: IBM
product: Qradar
Published: 2020-04-15T15:13:54.162Z
CVE-2019-4595 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 167878.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-02-24T15:35:29.653Z
CVE-2019-4596 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 167879.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-02-26T15:55:23.426Z
CVE-2019-4597 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167880.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-02-26T15:55:23.841Z
CVE-2019-4598 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167881.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-02-26T15:55:24.265Z
CVE-2019-4600 
IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 167883.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-10-28T23:36:12.179Z
CVE-2019-4601 
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2020-04-08T14:05:41.360Z
CVE-2019-4602 
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168293.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2020-04-08T14:05:41.794Z
CVE-2019-4603 
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2020-04-08T14:05:42.274Z
CVE-2019-4606 
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 High Performance Unload load for LUW
vendor: IBM
product: Db2 High Performance Unload load for LUW
Published: 2019-12-12T16:30:14.954Z
CVE-2019-4608 
IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168508.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Workload Scheduler
Published: 2020-03-10T11:55:15.798Z
CVE-2019-4609 
IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 168510.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-12-18T16:15:16.050Z
CVE-2019-4611 
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics
Published: 2019-12-09T22:30:24.315Z
CVE-2019-4612 
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2019-12-09T22:30:24.784Z
CVE-2019-4613 
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 168524.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-02-05T15:20:23.970Z
CVE-2019-4614 
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid message. IBM X-Force ID: 168639.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2020-01-28T18:30:52.540Z
CVE-2019-4616 
IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 168644.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Automation Manager
Published: 2020-02-05T15:20:24.401Z
CVE-2019-4617 
IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 168645.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Automation Manager
Published: 2020-03-16T15:25:19.609Z
CVE-2019-4619 
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ
Published: 2020-03-16T15:25:20.026Z
CVE-2019-4620 
IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-Force ID: 168863.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: MQ Appliance
Published: 2020-01-28T18:30:53.030Z
CVE-2019-4621 
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2019-12-09T22:30:25.250Z
CVE-2019-4623 
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168924.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2019-12-30T15:35:22.225Z
CVE-2019-4631 
IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 170001.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:53.460Z
CVE-2019-4632 
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:53.947Z
CVE-2019-4633 
IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:54.378Z
CVE-2019-4635 
IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elements. IBM X-Force ID: 170011.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:54.856Z
CVE-2019-4636 
IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:55.290Z
CVE-2019-4637 
IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:55.724Z
CVE-2019-4638 
IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:56.205Z
CVE-2019-4639 
IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 170045.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-01-28T18:30:56.694Z
CVE-2019-4640 
IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which could result in an attacker executing malicious code. IBM X-Force ID: 170046.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-02-19T15:15:45.051Z
CVE-2019-4644 
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-04-17T13:25:26.254Z
CVE-2019-4645 
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170881.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2019-11-09T01:41:11.637Z
CVE-2019-4650 
IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170961.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-06-26T13:45:30.407Z
CVE-2019-4651 
IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170962.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service (JRS)
Published: 2020-01-09T17:00:19.212Z
CVE-2019-4652 
IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2019-11-12T15:20:48.885Z
CVE-2019-4653 
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170964.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-05-31T15:10:39.100Z
CVE-2019-4654 
IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-ForceID: 170965.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Qradar
vendor: IBM
product: QRadar
Published: 2020-04-15T15:13:54.596Z
CVE-2019-4655 
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2019-12-30T15:35:22.708Z
CVE-2019-4656 
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due to an error processing error messages. IBM X-Force ID: 170967.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2020-03-16T15:25:20.439Z
CVE-2019-4663 
IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-12-10T16:10:24.526Z
CVE-2019-4665 
IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171247.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2019-12-11T14:25:17.749Z
CVE-2019-4666 
IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
vendor: IBM
product: UrbanCode Build
Published: 2020-02-13T15:40:21.747Z
CVE-2019-4667 
IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 171249.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-05-11T17:20:13.168Z
CVE-2019-4668 
IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-04-23T13:10:22.520Z
CVE-2019-4669 
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Business Automation Workflow
vendor: IBM
product: Business Process Manager
Published: 2020-02-27T16:10:16.660Z
CVE-2019-4670 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. IBM X-Force ID: 171319.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-02-05T15:20:24.877Z
CVE-2019-4671 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171437.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-09-15T13:50:23.236Z
CVE-2019-4672 
IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 171438.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Qradar Advisor
Published: 2020-02-25T13:55:18.453Z
CVE-2019-4674 
IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 171510.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2020-02-04T16:45:37.277Z
CVE-2019-4675 
IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2020-02-04T16:45:37.764Z
CVE-2019-4676 
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Manager Virtual Appliance
Published: 2020-07-01T14:25:29.182Z
CVE-2019-4679 
IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Content Navigator
Published: 2020-01-28T18:30:57.115Z
CVE-2019-4680 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171733.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-10-20T14:15:31.882Z
CVE-2019-4681 
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool Impact
Published: 2020-03-24T15:20:22.428Z