rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4688 
IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injection vulnerability. IBM X-Force ID: 186700.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-01-20T15:00:26.340Z
CVE-2020-4689 
IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium
Published: 2020-10-12T13:20:31.346Z
CVE-2020-4690 
IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 186697.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-09-23T16:05:24.078Z
CVE-2020-4691 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186698.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2021-01-08T20:40:23.887Z
CVE-2020-4692 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-16T16:40:36.811Z
CVE-2020-4693 
IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caused by improper validation of data prior to export. IBM X-Force ID: 186782.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2020-09-02T18:25:25.686Z
CVE-2020-4695 
IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, an attacker can view unencrypted data leading to a loss of confidentiality.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2021-03-08T18:00:24.838Z
CVE-2020-4696 
IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session. IBM X-Force ID: 186789.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2020-11-30T15:30:30.678Z
CVE-2020-4697 
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186790.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2021-01-08T20:40:24.603Z
CVE-2020-4698 
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Process Manager
vendor: IBM
product: Business Automation Workflow
Published: 2020-09-08T14:30:24.573Z
CVE-2020-4699 
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186947.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Access Manager
vendor: IBM
product: Security Verify Access
Published: 2020-10-12T13:05:35.713Z
CVE-2020-4700 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user group to create a user or group with administrative privileges. IBM X-Force ID: 187077.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-16T16:40:37.240Z
CVE-2020-4701 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2020-11-19T15:15:18.821Z
CVE-2020-4702 
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-09-04T13:35:17.875Z
CVE-2020-4703 
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. This vulnerability is due to an incomplete fix for CVE-2020-4470. IBM X-Force ID: 187188.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2020-09-15T13:50:25.453Z
CVE-2020-4704 
IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187189.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Content Navigator
Published: 2020-11-10T14:50:27.294Z
CVE-2020-4705 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187190.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2020-11-16T16:40:37.669Z
CVE-2020-4706 
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 187194.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: API Connect
Published: 2021-08-17T13:55:12.216Z
CVE-2020-4707 
IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187370.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: API Connect
Published: 2021-08-04T14:00:15.467Z
CVE-2020-4708 
IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin header. IBM X-Force ID: 187371.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Trusteer Pinpoint Detect
Published: 2020-09-16T15:55:14.860Z
CVE-2020-4711 
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 187501.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2020-09-15T13:50:25.884Z
CVE-2020-4717 
A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary file in another protected path during product installation. IBM X-Force ID: 187727.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: SPSS Modeler
Published: 2021-03-10T15:05:29.897Z
CVE-2020-4718 
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187731.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2020-11-19T15:15:19.249Z
CVE-2020-4719 
The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Cloud APM
Published: 2021-03-02T16:55:18.430Z
CVE-2020-4721 
IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187868.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: i2 Analyst Notebook
Published: 2020-10-29T15:50:32.772Z
CVE-2020-4722 
IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187870.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: i2 Analyst Notebook
Published: 2020-10-29T15:50:33.238Z
CVE-2020-4723 
IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187873.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: i2 Analyst Notebook
Published: 2020-10-29T15:50:33.653Z
CVE-2020-4724 
IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: i2 Analyst Notebook
Published: 2020-10-29T15:50:34.071Z
CVE-2020-4725 
IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which could mislead another user. IBM X-Force ID: 187974.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Cloud APM
Published: 2021-03-02T16:55:19.095Z
CVE-2020-4726 
The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud APM
Published: 2021-03-02T16:55:19.741Z
CVE-2020-4727 
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-09-25T17:00:18.900Z
CVE-2020-4729 IBM Safer Payments denial of service
IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted API requests that could cause the application to crash.  IBM X-Force ID:  188052.
Problem types: description: 399 Resource Management Errors
Affected products: vendor: IBM
product: Safer Payments
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-28T01:11:03.737Z
CVE-2020-4731 
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Aspera Shares
Published: 2020-09-21T14:55:25.579Z
CVE-2020-4732 
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Test Management
Published: 2021-06-02T20:40:37.689Z
CVE-2020-4733 
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Team Concert
Published: 2021-01-08T20:40:25.291Z
CVE-2020-4739 
IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 188149.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2020-11-20T13:50:14.651Z
CVE-2020-4740 
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-10-12T13:20:31.873Z
CVE-2020-4741 
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188197.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-10-12T13:20:32.301Z
CVE-2020-4747 
IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling Connect:Direct for UNIX
Published: 2020-12-15T14:45:21.900Z
CVE-2020-4748 
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-10-20T14:15:33.244Z
CVE-2020-4749 
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-10-20T14:15:33.677Z
CVE-2020-4755 
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-10-20T14:15:34.173Z
CVE-2020-4756 
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM X-Force ID: 188599.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Elastic Storage Server
vendor: IBM
product: Spectrum Scale
Published: 2020-10-20T14:15:34.611Z
CVE-2020-4757 
IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188600.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Content Navigator
Published: 2020-12-21T17:50:30.054Z
CVE-2020-4759 
IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: FileNet Content Manager
Published: 2020-11-09T20:25:18.355Z
CVE-2020-4760 
IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Content Navigator
Published: 2020-11-10T14:50:27.729Z
CVE-2020-4761 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-01-05T15:10:18.312Z
CVE-2020-4762 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-01-05T15:10:18.989Z
CVE-2020-4763 
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188897.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2020-11-16T16:40:38.102Z
CVE-2020-4764 
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 188898.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-12-18T15:00:16.957Z