rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4617 
IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 184930.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:43.983Z
CVE-2020-4618 
IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:44.424Z
CVE-2020-4619 
IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:44.863Z
CVE-2020-4620 
IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 184979.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:45.311Z
CVE-2020-4621 
IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IBM X-Force ID: 184981.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:45.802Z
CVE-2020-4622 
IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 184983.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Data Risk Manager
Published: 2020-09-22T13:55:46.293Z
CVE-2020-4623 
IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 184984.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: i2 iBase
Published: 2021-07-26T12:10:32.789Z
CVE-2020-4624 
IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2020-11-30T15:30:28.834Z
CVE-2020-4625 
IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2020-11-30T15:30:29.267Z
CVE-2020-4626 
IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2020-11-30T15:30:29.750Z
CVE-2020-4627 
IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2020-11-30T15:30:30.188Z
CVE-2020-4628 
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2021-01-27T13:05:25.438Z
CVE-2020-4629 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-09-30T14:35:14.492Z
CVE-2020-4631 
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2020-08-04T16:00:27.368Z
CVE-2020-4632 
IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to submit or control server requests. IBM X-Force ID: 185416.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-09-04T13:35:17.420Z
CVE-2020-4633 
IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Resilient
Published: 2020-12-11T14:20:14.376Z
CVE-2020-4635 
IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Resilient
Published: 2021-03-19T15:20:15.228Z
CVE-2020-4636 
IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Resilient OnPrem
Published: 2020-10-16T16:40:18.847Z
CVE-2020-4638 
IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate privileges by manipulating the invitation link. IBM X-Force ID: 185508.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: API Connect
Published: 2020-09-03T13:55:20.890Z
CVE-2020-4640 
Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2021-02-04T16:55:37.137Z
CVE-2020-4642 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a denial of service inside the "DB2 Management Service".
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-12-23T16:30:15.419Z
CVE-2020-4643 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-09-21T17:10:13.402Z
CVE-2020-4644 
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 185716.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-07-29T14:05:32.447Z
CVE-2020-4645 
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 185717.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-07-29T14:05:32.926Z
CVE-2020-4646 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an authenticated user to view pages they shoiuld not have access to due to improper authorization control.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-05-19T19:40:19.748Z
CVE-2020-4647 
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2020-11-16T16:40:34.458Z
CVE-2020-4648 
A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to do so. IBM X-Force ID: 186019.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-08-19T12:35:18.454Z
CVE-2020-4649 
IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
vendor: IBM
product: Planning Analytics Workspace
Published: 2020-11-03T13:25:21.309Z
CVE-2020-4650 
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Spatial Asset Management
Published: 2020-11-09T20:25:17.430Z
CVE-2020-4651 
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Spatial Asset Management
Published: 2020-11-09T20:25:17.867Z
CVE-2020-4653 
IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-08-19T12:35:18.934Z
CVE-2020-4654 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permission control. IBM X-Force ID: 186090.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-08T17:20:12.067Z
CVE-2020-4655 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 186091.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-16T16:40:34.940Z
CVE-2020-4657 
IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-12-16T20:35:26.059Z
CVE-2020-4658 
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186095.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2020-12-16T20:35:26.712Z
CVE-2020-4660 
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186140.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Access Manager
vendor: IBM
product: Security Verify Access
Published: 2020-10-12T13:05:34.819Z
CVE-2020-4661 
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186142.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Access Manager
vendor: IBM
product: Security Verify Access
Published: 2020-10-12T13:05:35.256Z
CVE-2020-4662 
IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Event Streams
Published: 2020-08-14T12:40:12.652Z
CVE-2020-4663 
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186234.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Requirements Quality Assistant
Published: 2021-01-08T14:45:25.596Z
CVE-2020-4664 
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186235.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Requirements Quality Assistant
Published: 2021-01-08T14:45:26.229Z
CVE-2020-4665 
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 186280.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2020-11-16T16:40:35.424Z
CVE-2020-4666 
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186281.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Requirements Quality Assistant
Published: 2021-01-08T14:45:26.864Z
CVE-2020-4667 
IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation. IBM X-Force ID: 186282.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Engineering Requirements Quality Assistant
Published: 2021-01-08T14:45:27.503Z
CVE-2020-4668 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186283.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2022-04-08T15:30:19.914Z
CVE-2020-4669 
IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 184600.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-05-17T17:10:14.686Z
CVE-2020-4670 
IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server. IBM X-Force ID: 186401.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-05-17T17:10:15.368Z
CVE-2020-4671 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that could be read by an authenticatedl user. IBM X-Force ID: 186284.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-16T16:40:35.851Z
CVE-2020-4672 
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2020-11-16T16:40:36.334Z
CVE-2020-4673 
IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Workload Automation
Published: 2021-01-12T14:45:25.492Z
CVE-2020-4674 
IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Workload Automation
Published: 2021-01-12T14:45:26.162Z
CVE-2020-4675 
IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186324.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Master Data Management
Published: 2021-07-16T16:50:21.687Z
CVE-2020-4678 
IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 186423.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2020-10-12T13:20:29.489Z
CVE-2020-4679 
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186424.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2020-10-12T13:20:29.923Z
CVE-2020-4680 
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186426.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2020-10-12T13:20:30.372Z
CVE-2020-4681 
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186427.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2020-10-12T13:20:30.856Z
CVE-2020-4682 
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: MQ
Published: 2021-01-28T12:55:15.366Z
CVE-2020-4685 
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cognos Controller
Published: 2020-11-11T12:55:14.029Z
CVE-2020-4686 
IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: SAN Volume Controller and Storwize Family
Published: 2020-08-17T12:35:12.569Z
CVE-2020-4687 
IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Content Navigator
Published: 2020-08-20T15:55:14.326Z