rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4925 
A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to service other requests. IBM X-Force ID: 191599.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2022-03-01T16:45:22.527Z
CVE-2020-4926 
A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
vendor: IBM
product: Elastic Storage System
Published: 2022-05-24T16:20:16.554Z
CVE-2020-4927 IBM Spectrum Scale information disclosure
A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol.  IBM X-Force ID:  191695.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Spectrum Scale
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2023-03-15T18:11:14.873Z
CVE-2020-4928 
IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:38.935Z
CVE-2020-4929 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191706.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:31.256Z
CVE-2020-4931 
IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-Force ID: 191747.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-02-24T17:20:13.887Z
CVE-2020-4932 
IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 191748.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:31.920Z
CVE-2020-4933 
IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2021-02-18T15:10:44.071Z
CVE-2020-4934 
IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 191752.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Content Navigator
Published: 2021-02-02T14:35:13.498Z
CVE-2020-4935 
IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191753.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Datacap Navigator
Published: 2021-07-01T15:40:14.218Z
CVE-2020-4937 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 191814.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-20T13:50:15.078Z
CVE-2020-4938 
IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-07-12T16:05:26.126Z
CVE-2020-4941 
IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Edge
Published: 2021-09-23T17:10:29.104Z
CVE-2020-4942 
IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Curam SPM
Published: 2021-01-04T14:00:39.581Z
CVE-2020-4944 
IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain text after a manual edit, which can be read by a local user. IBM X-Force ID: 191944.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2021-03-30T16:00:27.121Z
CVE-2020-4945 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: DB2 for Linux and UNIX
Published: 2021-06-24T18:45:26.111Z
CVE-2020-4949 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-01-26T14:25:17.496Z
CVE-2020-4951 
IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-10-15T15:55:17.303Z
CVE-2020-4952 
IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-Force ID: 192028.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-01-27T16:35:34.189Z
CVE-2020-4953 
IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP repsonses. IBM X-Force ID: 192029.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-02-23T15:20:16.758Z
CVE-2020-4954 
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2021-02-15T15:05:19.339Z
CVE-2020-4955 
IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2021-02-15T15:05:20.081Z
CVE-2020-4956 
IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2021-02-15T15:05:21.174Z
CVE-2020-4957 
IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the system. IBM X-Force ID: 192208.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2022-05-17T16:00:18.202Z
CVE-2020-4958 
IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 192209.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-01-21T14:00:26.087Z
CVE-2020-4964 
IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
Published: 2021-04-12T18:00:23.918Z
CVE-2020-4965 
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-04-12T18:00:24.743Z
CVE-2020-4966 
IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 192423.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-01-21T14:00:26.720Z
CVE-2020-4967 
IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2021-01-27T13:05:28.011Z
CVE-2020-4968 
IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-01-21T14:00:27.357Z
CVE-2020-4969 
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-01-21T14:00:28.000Z
CVE-2020-4970 
IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 192429.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2022-05-19T16:05:11.447Z
CVE-2020-4974 
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-07-28T12:25:11.431Z
CVE-2020-4975 
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
Published: 2021-03-04T19:05:42.516Z
CVE-2020-4976 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due to weak file permissions. IBM X-Force ID: 192469.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2021-03-11T15:30:25.232Z
CVE-2020-4977 
IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192470.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-06-02T20:40:38.393Z
CVE-2020-4979 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:32.638Z
CVE-2020-4980 
IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data at rest. IBM X-Force ID: 192539.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar
Published: 2021-07-16T16:50:25.631Z
CVE-2020-4981 
IBM Spectrum Scale 5.0.4.1 through 5.1.0.3 could allow a local privileged user to overwrite files due to improper input validation. IBM X-Force ID: 192541.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-04-27T16:32:49.829Z
CVE-2020-4983 
IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary commands. IBM X-Force ID: 192586.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum LSF Suite
vendor: IBM
product: Spectrum LSF
Published: 2021-01-20T15:00:29.635Z
CVE-2020-4985 
IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-05-14T16:15:34.559Z
CVE-2020-4987 
The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: FlashSystem 900
Published: 2021-05-04T15:45:14.502Z
CVE-2020-4988 
Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of service or possibly execute code. IBM X-Force ID: 192706.
Problem types: description: Gain Access
Affected products: vendor: Loopback
product: Loopback
Published: 2020-12-21T17:50:13.815Z
CVE-2020-4989 
IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive information about build definitions. IBM X-Force ID: 192707.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
Published: 2022-03-15T17:00:14.828Z
CVE-2020-4990 
IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 192710.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:37.342Z
CVE-2020-4992 
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2021-08-17T13:55:13.982Z
CVE-2020-4993 
IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path traversal attacks. IBM X-Force ID: 192905.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:33.324Z
CVE-2020-4994 
IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2022-05-17T16:25:18.615Z
CVE-2020-4995 
IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' session. IBM X-Force ID: 192912.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-02-09T14:50:23.629Z
CVE-2020-4996 
IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentication credentials. IBM X-Force ID: 192913.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Identity Governance and Intelligence
Published: 2021-02-09T14:50:24.289Z
CVE-2020-4997 
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192914
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2021-04-05T16:20:17.192Z
CVE-2020-5000 
IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192952.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Financial Transaction Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: HIGH
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.2
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-06-15T19:11:53.444Z