rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20334 Local privilege escalation in MongoDB Compass for Windows
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: MongoDB Inc.
product: MongoDB Compass
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Hou JingYi (@hjy79425575)
Published: 2021-04-06T16:45:20.154Z
CVE-2021-20335 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: MongoDB Inc.
product: MongoDB Ops Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-02-11T10:10:13.856Z
CVE-2021-20336 
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus_GUI
Published: 2021-03-11T15:30:27.266Z
CVE-2021-20337 
IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 194448.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-07-26T12:10:34.395Z
CVE-2021-20338 
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194449.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational DOORS Next Generation
Published: 2021-06-02T20:40:39.803Z
CVE-2021-20340 
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194451.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
Published: 2021-03-04T19:05:43.218Z
CVE-2021-20341 
IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the system. IBM X-Force ID: 194513.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Multicloud Management Monitoring
Published: 2021-03-09T14:55:13.340Z
CVE-2021-20343 
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-06-02T20:40:40.575Z
CVE-2021-20345 
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-06-02T20:40:41.294Z
CVE-2021-20346 
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Test Management
Published: 2021-06-02T20:40:41.976Z
CVE-2021-20347 
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194596.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Test Management
Published: 2021-06-02T20:40:42.715Z
CVE-2021-20348 
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-06-02T20:40:43.390Z
CVE-2021-20349 
IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 194599.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Workload Scheduler
Published: 2021-08-09T16:05:12.746Z
CVE-2021-20350 
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-03-04T19:05:43.976Z
CVE-2021-20351 
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194708.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
Published: 2021-03-04T19:05:44.675Z
CVE-2021-20352 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194710.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Team Concert
Published: 2021-03-30T16:45:29.336Z
CVE-2021-20353 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-02-10T17:00:19.962Z
CVE-2021-20354 
IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-02-18T15:10:45.009Z
CVE-2021-20355 
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 194891.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Jazz Team Server
Published: 2022-06-24T16:15:31.741Z
CVE-2021-20357 
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194963.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2021-01-27T16:15:28.467Z
CVE-2021-20358 
IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be obtained by a user with permissions to read log files. IBM X-Force ID: 194965.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Automation
Published: 2021-02-08T14:40:18.442Z
CVE-2021-20359 
IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files that could be obtained by an unauthorized user. IBM X-Force ID: 194966.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Automation
Published: 2021-02-08T14:40:19.138Z
CVE-2021-20360 
IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195031.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:31.911Z
CVE-2021-20361 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195032.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:33.537Z
CVE-2021-20362 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195033.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:35.110Z
CVE-2021-20363 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195034.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:36.693Z
CVE-2021-20364 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195035.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:38.250Z
CVE-2021-20365 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195036.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:40.101Z
CVE-2021-20366 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195037.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:41.678Z
CVE-2021-20368 
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195357.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:43.257Z
CVE-2021-20369 
IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195361.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:44.879Z
CVE-2021-20371 
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Test Management
Published: 2021-06-02T20:40:44.116Z
CVE-2021-20372 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:43.632Z
CVE-2021-20373 
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2021-12-09T17:00:24.045Z
CVE-2021-20374 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195522.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2021-05-19T19:40:21.127Z
CVE-2021-20375 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:45.376Z
CVE-2021-20376 
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2021-10-07T18:05:46.999Z
CVE-2021-20377 
IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195569.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-09-23T16:05:30.579Z
CVE-2021-20378 
IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:26.982Z
CVE-2021-20379 
IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195711.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:28.694Z
CVE-2021-20380 
IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 195712.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Qradar Advisor
Published: 2021-06-03T14:45:10.319Z
CVE-2021-20385 
IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 195766.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:37.990Z
CVE-2021-20386 
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195767.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:38.631Z
CVE-2021-20389 
IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:39.271Z
CVE-2021-20391 
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-14T16:15:35.235Z
CVE-2021-20392 
IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-14T16:15:35.913Z