rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4476 
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181778.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2020-11-16T16:40:33.515Z
CVE-2020-4477 
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2020-06-15T13:25:27.269Z
CVE-2020-4481 
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848.
Problem types: description: Informational
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-08-05T13:15:17.166Z
CVE-2020-4482 
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access to a snapshot could apply unauthorized additional statuses via direct rest calls. IBM X-Force ID: 181856.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-11-06T13:40:18.669Z
CVE-2020-4483 
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-11-06T13:40:19.112Z
CVE-2020-4484 
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could be used in further attacks against the system. IBM X-Force ID: 181858.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2020-11-06T13:40:19.591Z
CVE-2020-4485 
IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing security mechanisms in future attacks. IBM X-Force ID: 181860.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: QRadar Wincollect
Published: 2020-08-11T12:05:16.139Z
CVE-2020-4486 
IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation. IBM X-Force ID: 181861.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: QRadar Wincollect
Published: 2020-08-11T12:05:16.553Z
CVE-2020-4487 
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181862.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Quality Manager
Published: 2021-01-08T20:40:22.413Z
CVE-2020-4490 
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Business Process Manager Advanced
vendor: IBM
product: Business Automation Workflow
Published: 2020-05-29T13:10:20.704Z
CVE-2020-4491 
IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-10-20T14:15:32.316Z
CVE-2020-4492 
IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by sending a subset of ioctls on the device with invalid arguments. IBM X-Force ID: 181992.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-08-31T12:55:14.240Z
CVE-2020-4493 
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HTTP command. IBM X-Force ID: 181995.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-10-05T13:25:14.828Z
CVE-2020-4494 
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow an attacker to bypass authentication due to improper session validation which can result in access to unauthorized resources. IBM X-Force ID: 182019.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect for Space Management (Linux)
vendor: IBM
product: Spectrum Protect for Space Management (AIX)
vendor: IBM
product: Spectrum Protect Client (AIX)
vendor: IBM
product: Spectrum Protect Client (Linux and Windows)
Published: 2020-06-15T13:25:27.712Z
CVE-2020-4495 
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational DOORS Next Generation
Published: 2021-06-02T20:40:37.009Z
CVE-2020-4496 
The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2021-12-13T18:35:29.007Z
CVE-2020-4497 IBM Spectrum Protect Plus information disclosure

IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106.


Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-12-14T21:50:35.313Z
CVE-2020-4498 
IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM X-Force ID: 182118.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ Appliance
Published: 2020-07-27T13:31:24.867Z
CVE-2020-4499 
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Verify Access
vendor: IBM
product: Security Access Manager
Published: 2020-10-15T12:40:21.263Z
CVE-2020-4503 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182283.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2020-06-02T13:45:23.847Z
CVE-2020-4509 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-06-04T13:35:19.279Z
CVE-2020-4510 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182365.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-07-14T13:10:20.069Z
CVE-2020-4511 
IBM QRadar SIEM 7.3 and 7.4 could allow an authenticated user to cause a denial of service of the qflow process by sending a malformed sflow command. IBM X-Force ID: 182366.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-07-14T13:10:20.564Z
CVE-2020-4512 
IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-07-14T13:10:21.000Z
CVE-2020-4513 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182368.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-07-14T13:10:21.434Z
CVE-2020-4516 
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Process Manager
vendor: IBM
product: Business Automation Workflow
Published: 2020-09-08T14:30:24.140Z
CVE-2020-4520 
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-05-31T15:10:43.979Z
CVE-2020-4521 
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 182396.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-09-15T13:50:24.105Z
CVE-2020-4522 
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182397.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Team Concert
Published: 2020-09-02T18:25:24.836Z
CVE-2020-4524 
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182434.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Rhapsody Model Manager
Published: 2021-01-27T16:15:25.871Z
CVE-2020-4525 
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182435.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2020-08-04T16:00:26.440Z
CVE-2020-4526 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 182436.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-09-15T13:50:24.589Z
CVE-2020-4527 
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 182631.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-07-20T14:05:25.090Z
CVE-2020-4528 
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. IBM X-Force ID: 182658.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2020-10-06T15:45:16.283Z
CVE-2020-4529 
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 182713.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2020-06-08T12:55:12.661Z
CVE-2020-4530 
IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Process Manager
vendor: IBM
product: Business Automation Workflow
Published: 2020-09-15T13:50:25.023Z
CVE-2020-4531 
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Workflow
vendor: IBM
product: Business Process Manager
Published: 2020-09-25T17:00:18.465Z
CVE-2020-4532 
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Process Manager Express
Published: 2020-06-17T17:40:12.479Z
CVE-2020-4533 
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182717.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2020-08-10T12:35:16.481Z
CVE-2020-4534 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-08-03T12:35:38.468Z
CVE-2020-4535 
IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182906.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: OpenPages GRC Platform
Published: 2021-05-11T15:45:17.129Z
CVE-2020-4536 
IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182907.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: OpenPages GRC Platform
Published: 2021-05-11T15:45:17.801Z
CVE-2020-4539 
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2020-08-10T12:35:16.901Z
CVE-2020-4541 
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183039.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2020-08-10T12:35:17.424Z
CVE-2020-4542 
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 183046.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2020-08-04T16:00:26.903Z
CVE-2020-4544 
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 183189.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2021-01-08T20:40:23.147Z
CVE-2020-4545 
IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183190.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Aspera Connect
Published: 2020-09-04T13:35:16.983Z
CVE-2020-4546 
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2020-09-02T18:25:25.260Z