rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20455 IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-07T16:04:37.010Z
CVE-2021-20461 
IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could potentially bypass business logic to modify the appearance and behavior of the application. IBM X-Force ID: 196770.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-06-30T13:25:12.039Z
CVE-2021-20464 
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-04-22T16:30:29.386Z
CVE-2021-20468 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 196825.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-09-01T19:00:25.473Z
CVE-2021-20470 
IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-12-03T17:00:22.867Z
CVE-2021-20473 
IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:48.587Z
CVE-2021-20474 
IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:35.145Z
CVE-2021-20477 
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-06-29T15:50:19.234Z
CVE-2021-20478 
IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-07-20T17:10:14.951Z
CVE-2021-20479 
IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197498.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2022-05-09T16:35:18.335Z
CVE-2021-20480 
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-04-08T12:20:13.914Z
CVE-2021-20481 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197503.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:50.355Z
CVE-2021-20482 
IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Automation
Published: 2021-03-30T16:00:27.881Z
CVE-2021-20483 
IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2021-06-16T16:15:18.128Z
CVE-2021-20484 
IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197666.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-09-23T17:10:33.935Z
CVE-2021-20485 
IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197667.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-09-23T17:10:35.541Z
CVE-2021-20486 
IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Data
Published: 2021-05-26T16:20:17.082Z
CVE-2021-20487 
IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Power 9 Systems
Published: 2021-05-26T16:20:17.769Z
CVE-2021-20488 
IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2021-06-16T16:15:19.775Z
CVE-2021-20489 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:52.087Z
CVE-2021-20490 
IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2021-06-29T15:50:20.821Z
CVE-2021-20491 
IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Protect Server
Published: 2021-04-16T15:40:15.491Z
CVE-2021-20492 
IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-05-26T16:20:18.402Z
CVE-2021-20493 
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197794.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-12-03T17:00:24.294Z
CVE-2021-20494 
IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap based buffer overflow, caused by improper bounds. An authenticared user could overflow the buffer and cause the service to crash. IBM X-Force ID: 197882.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Identity Manager Adapters
Published: 2021-06-28T16:10:19.260Z
CVE-2021-20496 
IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:47.288Z
CVE-2021-20497 
IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197969
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:48.911Z
CVE-2021-20498 
IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:50.474Z
CVE-2021-20499 
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:52.086Z
CVE-2021-20500 
IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:53.660Z
CVE-2021-20501 
IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An attacker could exploit this vulnerability to consume unnecessary network bandwidth and disk space, and allow remote attackers to send spam email. IBM X-Force ID: 198056.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: i
Published: 2021-04-21T12:05:22.224Z
CVE-2021-20502 
IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 198059.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Team Concert
Published: 2021-03-30T16:45:30.720Z
CVE-2021-20503 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198182.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-03-30T16:45:31.424Z
CVE-2021-20504 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-03-30T16:45:32.118Z
CVE-2021-20505 
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: PowerVM Hypervisor
Published: 2021-07-29T12:00:12.703Z
CVE-2021-20506 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Team Concert
Published: 2021-03-30T16:45:32.794Z
CVE-2021-20507 
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198235.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2021-07-19T16:00:25.382Z
CVE-2021-20508 
IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2021-09-14T13:25:22.106Z
CVE-2021-20509 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2021-08-12T16:05:10.550Z
CVE-2021-20510 
IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:55.220Z
CVE-2021-20511 
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 198300.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:56.769Z
CVE-2021-20515 
IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged user could overflow a buffer and execute arbitrary code on the system or cause a denial of service condition. IBM X-Force ID: 198366.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Informix Dynamic Server
Published: 2021-04-30T15:45:15.878Z
CVE-2021-20517 
IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: WebSphere Application Server ND
Published: 2021-06-07T14:05:14.362Z
CVE-2021-20518 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198437.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-03-30T16:45:33.454Z
CVE-2021-20519 
IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198441.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Rhapsody Model Manager
Published: 2021-04-12T18:00:25.456Z
CVE-2021-20520 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198572.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-03-30T16:45:34.161Z
CVE-2021-20523 
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:15:58.446Z
CVE-2021-20524 
IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198661.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:16:00.076Z
CVE-2021-20526 
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-10-27T16:00:23.291Z
CVE-2021-20527 
IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Resilient OnPrem
Published: 2021-04-19T16:20:13.202Z
CVE-2021-20528 
IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Control Center
Published: 2021-05-19T19:40:21.800Z
CVE-2021-20529 
IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Control Center
Published: 2021-05-19T19:40:22.557Z
CVE-2021-20532 
IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure directory permissions. IBM X-Force ID: 198811.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect for Virtual Environments
Published: 2021-04-26T16:30:43.722Z
CVE-2021-20533 
IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Verify Access Docker
Published: 2021-07-15T17:16:01.680Z