rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-4392 
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
Problem types: description: Broken authentication
Affected products: vendor: IBM Corporation
product: HCL AppScan Standard Edition
Published: 2020-02-14T21:10:08.000Z
CVE-2019-4393 
HCL AppScan Standard is vulnerable to excessive authorization attempts
Problem types: description: "Broken Authentication"
Affected products: vendor: n/a
product: HCL AppScan Standard Edition
Published: 2020-04-07T15:14:27.000Z
CVE-2019-4394 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:35.128Z
CVE-2019-4395 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:35.631Z
CVE-2019-4396 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 162236.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:36.075Z
CVE-2019-4397 
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-24T12:00:37.660Z
CVE-2019-4398 
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-24T12:00:38.147Z
CVE-2019-4399 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 162260.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:36.509Z
CVE-2019-4400 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162261.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:37.011Z
CVE-2019-4402 
IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID: 162263.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: API Connect
Published: 2019-08-20T18:25:26.662Z
CVE-2019-4403 
IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Connections
Published: 2019-06-14T14:45:18.106Z
CVE-2019-4406 
IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Protect Backup-Archive Client
Published: 2019-11-25T17:01:24.440Z
CVE-2019-4409 
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.
Problem types: description: Cross-site scripting
Affected products: vendor: HCL
product: HCL Traveler
Published: 2019-10-18T19:28:38.000Z
CVE-2019-4410 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-07-01T15:05:38.491Z
CVE-2019-4411 
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Controller
Published: 2019-11-09T01:41:07.777Z
CVE-2019-4412 
IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162659.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Controller
Published: 2019-11-09T01:41:08.188Z
CVE-2019-4415 
IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-07-25T14:30:21.128Z
CVE-2019-4419 
IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Intelligent Operations Center
Published: 2019-08-20T18:25:26.712Z
CVE-2019-4420 
IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Intelligent Operations Center
Published: 2019-08-20T18:25:26.760Z
CVE-2019-4422 
IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. IBM X-Force ID: 162768.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Guardium
Published: 2019-10-03T14:05:17.804Z
CVE-2019-4423 
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162769.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2019-09-30T15:20:32.446Z
CVE-2019-4424 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-08-20T19:30:25.574Z
CVE-2019-4425 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2019-08-20T18:25:26.812Z
CVE-2019-4426 
The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
vendor: IBM
product: Case Manager
Published: 2019-12-13T15:50:14.191Z
CVE-2019-4427 
IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud CLI
Published: 2020-02-12T16:10:17.298Z
CVE-2019-4428 
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162807.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Watson Assistant for IBM Cloud Pak for Data
Published: 2019-12-09T22:30:23.849Z
CVE-2019-4429 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162886.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-02-19T15:15:44.172Z
CVE-2019-4430 
IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162887.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2019-07-17T14:05:21.048Z
CVE-2019-4431 
IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162888.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Publishing Engine
Published: 2020-02-12T16:10:17.720Z
CVE-2019-4433 
IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162890.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Identity Insight
vendor: IBM
product: InfoSphere Global Name Management
Published: 2019-08-20T18:25:26.864Z
CVE-2019-4437 
IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-08-20T19:30:25.622Z
CVE-2019-4439 
IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 162949.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-07-25T14:30:21.204Z
CVE-2019-4441 
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-10-03T14:05:18.453Z
CVE-2019-4442 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-17T19:05:24.079Z
CVE-2019-4444 
IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-12-16T15:45:15.836Z
CVE-2019-4446 
IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-04-17T13:25:25.783Z
CVE-2019-4447 
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trusts the PATH environment variable. A low privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user controlled location. When a crash is induced the trojan gdb command is executed. IBM X-Force ID: 163488.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 High Performance Unload load for LUW
Published: 2019-08-26T14:40:14.912Z
CVE-2019-4448 
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum and db2hpum_debug binaries are setuid root and have built-in options that allow an low privileged user the ability to load arbitrary db2 libraries from a privileged context. This results in arbitrary code being executed with root authority. IBM X-Force ID: 163489.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 High Performance Unload load for LUW
Published: 2019-08-26T14:40:14.962Z
CVE-2019-4450 
IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163492.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: i
Published: 2019-11-09T01:41:08.719Z
CVE-2019-4451 
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2020-02-04T16:45:34.147Z
CVE-2019-4454 
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163618.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar
Published: 2019-11-09T01:41:09.236Z
CVE-2019-4456 
IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 163620.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Daeja ViewONE
Published: 2019-07-30T13:25:14.949Z
CVE-2019-4457 
IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 163654.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2020-02-19T15:15:44.644Z
CVE-2019-4459 
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-24T12:00:38.679Z
CVE-2019-4460 
IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 163681.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-08-20T18:25:26.918Z
CVE-2019-4461 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of content. This would allow the attacker to perform further attacks, such as Web Cache poisoning, cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 163682.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Orchestrator
Published: 2019-10-25T16:30:37.444Z
CVE-2019-4465 
IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2019-12-03T14:55:23.910Z
CVE-2019-4467 
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163776.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2019-12-03T14:55:24.341Z
CVE-2019-4468 
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163777.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2019-12-03T14:55:24.759Z
CVE-2019-4470 
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163779.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar
Published: 2019-11-09T01:41:09.707Z
CVE-2019-4471 
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-05-31T15:10:38.437Z
CVE-2019-4473 
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Java
Published: 2019-08-05T13:40:15.625Z
CVE-2019-4477 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line options. IBM X-Force ID: 163997.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-17T19:05:24.132Z
CVE-2019-4478 
IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. IBM X-Force ID: 163998.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-05-12T13:40:16.773Z
CVE-2019-4481 
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164064.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Emptoris Spend Analysis
vendor: IBM
product: Contract Management
Published: 2019-08-20T18:25:26.966Z
CVE-2019-4482 
IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164066.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Spend Analysis
Published: 2019-08-20T19:30:25.671Z
CVE-2019-4483 
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164067.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Contract Management
vendor: IBM
product: Emptoris Spend Analysis
Published: 2019-08-20T18:25:27.014Z