rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20393 
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-14T16:15:36.593Z
CVE-2021-20396 
IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Analyst Workflow
Published: 2021-06-11T14:25:18.831Z
CVE-2021-20397 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196017.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:34.710Z
CVE-2021-20399 
IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196073.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-07-27T11:25:15.517Z
CVE-2021-20400 
IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196074.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-12-01T17:05:20.463Z
CVE-2021-20401 
IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196075.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:35.422Z
CVE-2021-20402 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196076.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-11T16:30:29.414Z
CVE-2021-20403 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-11T16:30:30.030Z
CVE-2021-20404 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-11T16:30:30.698Z
CVE-2021-20405 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized activities due to improper encoding of output. IBM X-Force ID: 196183.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-11T16:30:31.367Z
CVE-2021-20406 IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196184.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: IBM
product: Security Verify Information Queue
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-02-12T16:35:27.889Z
CVE-2021-20407 IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system.  IBM X-Force ID:  196185.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-02-12T16:35:28.561Z
CVE-2021-20408 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-12T16:35:29.239Z
CVE-2021-20409 IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 196188.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-02-12T16:35:29.866Z
CVE-2021-20410 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-12T16:35:30.481Z
CVE-2021-20411 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session identifier. IBM X-Force ID: 198191.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-12T16:35:31.156Z
CVE-2021-20412 
IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 198192.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2021-02-12T16:35:31.824Z
CVE-2021-20413 
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196212.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-06-28T15:55:22.204Z
CVE-2021-20414 
IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM X-Force ID: 196216.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-12T16:05:27.698Z
CVE-2021-20415 
IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:30.260Z
CVE-2021-20416 
IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:31.877Z
CVE-2021-20417 
IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Guardium Data Encryption
Published: 2021-07-07T16:30:33.464Z
CVE-2021-20418 
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-08-11T15:55:16.020Z
CVE-2021-20419 
IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196280.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:39.902Z
CVE-2021-20420 
IBM Security Guardium 11.2 could disclose sensitive information due to reliance on untrusted inputs that could aid in further attacks against the system. IBM X-Force ID: 196281.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-08-11T15:55:17.647Z
CVE-2021-20421 
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Jazz Team Server
Published: 2022-06-24T16:15:33.782Z
CVE-2021-20422 
IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:46.530Z
CVE-2021-20423 
IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:48.090Z
CVE-2021-20424 
IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Applications
Published: 2021-07-13T16:10:49.635Z
CVE-2021-20426 
IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196313.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:40.552Z
CVE-2021-20427 
IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-08-11T15:55:19.226Z
CVE-2021-20428 
IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196315.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-05-24T13:55:41.184Z
CVE-2021-20429 
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 196334.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-14T16:15:37.361Z
CVE-2021-20430 
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: i2 Analyze
Published: 2021-07-26T12:10:36.014Z
CVE-2021-20431 
IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: i2 Analyst's Notebook Premium
Published: 2021-07-26T12:10:37.587Z
CVE-2021-20432 
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2021-04-26T16:30:43.094Z
CVE-2021-20433 
IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 196345.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-09-15T17:55:15.650Z
CVE-2021-20434 
IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 196346.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Bridge
Published: 2021-09-23T17:10:30.776Z
CVE-2021-20435 
IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 196355.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Bridge
Published: 2021-09-23T17:10:32.332Z
CVE-2021-20439 
IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access Docker
vendor: IBM
product: Security Access Manager
Published: 2021-07-15T16:00:16.215Z
CVE-2021-20440 
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider organization. IBM X-Force ID: 196536.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2021-03-15T15:30:17.410Z
CVE-2021-20441 
IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196617.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Bridge
Published: 2021-03-03T17:00:22.155Z
CVE-2021-20442 
IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196618.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Bridge
Published: 2021-03-03T17:00:23.245Z
CVE-2021-20443 
IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. IBM X-Force ID: 196619.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Maximo for Civil Infrastructure
Published: 2021-02-18T15:10:45.696Z
CVE-2021-20444 
IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo for Civil Infrastructure
Published: 2021-02-18T15:10:46.332Z
CVE-2021-20445 
IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo for Civil Infrastructure
Published: 2021-02-18T15:10:46.975Z
CVE-2021-20446 
IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo for Civil Infrastructure
Published: 2021-02-18T15:10:47.633Z
CVE-2021-20447 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196623.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-03-30T16:45:30.002Z
CVE-2021-20448 
IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196624.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Content Navigator
Published: 2021-04-27T16:32:50.481Z
CVE-2021-20450 IBM Cognos Controller information disclosure
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.  IBM X-Force ID:  196640.
Problem types: description: 614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: IBM
product: Cognos Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-05-03T16:55:57.932Z
CVE-2021-20451 IBM Cognos Controller SQL injection
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  196643.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: IBM
product: Cognos Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2024-05-03T18:16:24.867Z
CVE-2021-20453 
IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-04-20T11:35:14.771Z
CVE-2021-20454 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-04-21T12:05:20.721Z