rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4856 
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190459.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
Published: 2021-03-04T19:05:39.571Z
CVE-2020-4857 
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190460.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
Published: 2021-03-04T19:05:40.309Z
CVE-2020-4863 
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
Published: 2021-03-04T19:05:41.061Z
CVE-2020-4864 
IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP address. IBM X-Force ID: 190567.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Resilient OnPrem
Published: 2020-10-29T15:50:34.491Z
CVE-2020-4865 
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Rhapsody Model Manager
Published: 2021-01-27T16:15:27.819Z
CVE-2020-4866 
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190742.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
Published: 2021-03-04T19:05:41.813Z
CVE-2020-4868 IBM TRIRIGA information disclosure
IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  190744.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: TRIRIGA Application Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-07-31T01:37:47.641Z
CVE-2020-4869 
IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP query to cause the appliance to reload. IBM X-Force ID: 190831.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-01-11T17:10:15.276Z
CVE-2020-4870 
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. IBM X-Force ID: 190833.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
vendor: IBM
product: MQ Appliance
Published: 2020-12-21T17:50:32.362Z
CVE-2020-4871 
IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-01-19T15:20:25.504Z
CVE-2020-4873 
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-01-19T15:20:26.191Z
CVE-2020-4874 IBM Cognos Controller information disclosure
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  190837.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: IBM
product: Cognos Controller
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-05-03T16:47:19.927Z
CVE-2020-4875 
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190838.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Controller
Published: 2022-01-21T17:20:17.045Z
CVE-2020-4876 
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190839.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Controller
Published: 2022-01-21T17:20:18.549Z
CVE-2020-4877 
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 190843.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cognos Controller
Published: 2022-01-21T17:20:20.280Z
CVE-2020-4879 
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cognos Controller
Published: 2022-01-21T17:20:21.768Z
CVE-2020-4881 
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS communication. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 190851.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-01-19T15:20:26.824Z
CVE-2020-4882 
IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 190852.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2021-03-22T17:00:15.627Z
CVE-2020-4883 
IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the system. IBM X-Force ID: 190907.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-05-05T15:45:30.594Z
CVE-2020-4884 
IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 190908.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2021-03-30T16:00:26.474Z
CVE-2020-4885 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: DB2 for Linux and UNIX
Published: 2021-06-24T18:45:24.474Z
CVE-2020-4886 
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-11-13T15:10:16.765Z
CVE-2020-4887 
IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2021-01-20T15:00:27.437Z
CVE-2020-4888 
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 190912.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-01-28T12:55:15.998Z
CVE-2020-4889 
IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190971.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-01-26T14:25:16.856Z
CVE-2020-4890 
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-03-16T13:55:16.333Z
CVE-2020-4891 
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-03-16T13:55:16.975Z
CVE-2020-4892 
IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Contract Management
Published: 2021-01-07T17:40:27.447Z
CVE-2020-4893 
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2021-01-07T17:40:28.080Z
CVE-2020-4895 
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2021-01-07T17:40:28.748Z
CVE-2020-4896 
IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2021-01-07T17:40:29.367Z
CVE-2020-4897 
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190988.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Contract Management
vendor: IBM
product: Emptoris Spend Analysis
Published: 2021-01-07T17:40:29.989Z
CVE-2020-4898 
IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2021-01-07T17:40:30.652Z
CVE-2020-4899 
IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive information across the network. IBM X-Force ID: 190990.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2021-01-05T15:10:19.626Z
CVE-2020-4900 
IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2020-11-30T15:30:31.161Z
CVE-2020-4901 
IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of service through username enumeration. IBM X-Force ID: 190992.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2021-05-07T15:45:13.770Z
CVE-2020-4902 
IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191045.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Datacap Navigator
Published: 2021-07-01T15:40:12.598Z
CVE-2020-4903 
IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user or obtain sensitive information. IBM X-Force ID: 191105.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2021-03-08T18:00:25.563Z
CVE-2020-4904 
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-12-16T20:35:27.394Z
CVE-2020-4905 
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain sensitive information, caused by a man in the middle attack. By SSL striping, an attacker could exploit this vulnerability to obtain sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-12-16T20:35:28.033Z
CVE-2020-4906 
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-12-16T20:35:28.667Z
CVE-2020-4907 
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-12-16T20:35:29.313Z
CVE-2020-4908 
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-12-16T20:35:29.958Z
CVE-2020-4909 
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:33.475Z
CVE-2020-4910 
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:34.122Z
CVE-2020-4912 
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:34.812Z
CVE-2020-4913 
IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:35.556Z
CVE-2020-4914 IBM Cloud Pak System Software Suite session fixation
IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system.  IBM X-Force ID:  191290.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Cloud Pak System Software Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-05-05T18:17:10.598Z
CVE-2020-4916 
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191390.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:36.207Z
CVE-2020-4917 
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:36.896Z
CVE-2020-4918 
IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:37.535Z
CVE-2020-4919 
IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Pak System
Published: 2021-01-04T14:00:38.182Z
CVE-2020-4920 
IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Rhapsody Model Manager
Published: 2021-04-12T18:00:23.065Z
CVE-2020-4921 
IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191398.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Security Guardium
Published: 2021-01-20T15:00:28.538Z