rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29815 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204340.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:42.128Z
CVE-2021-29816 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204341.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:43.772Z
CVE-2021-29817 
IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204343.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:49.918Z
CVE-2021-29818 
IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204345.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:51.511Z
CVE-2021-29819 
IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204346.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:53.154Z
CVE-2021-29820 
IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204347.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:54.858Z
CVE-2021-29821 
IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204348.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:56.486Z
CVE-2021-29822 
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204349.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-07-12T16:05:37.160Z
CVE-2021-29823 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204465.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-09-01T19:00:26.421Z
CVE-2021-29824 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-04-22T16:30:31.057Z
CVE-2021-29825 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2021-09-16T15:50:20.270Z
CVE-2021-29827 IBM InfoSphere Information Server clickjacking
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-18T23:44:18.973Z
CVE-2021-29831 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 204775.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-21T16:00:16.216Z
CVE-2021-29832 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204824.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:45.366Z
CVE-2021-29833 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204825.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:46.993Z
CVE-2021-29834 
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
vendor: IBM
product: Business Process Manager
Published: 2021-09-29T15:55:11.692Z
CVE-2021-29835 
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2021-10-22T19:00:12.252Z
CVE-2021-29836 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0. through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204912.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-10-06T17:10:39.325Z
CVE-2021-29837 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204913.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-10-06T17:10:41.108Z
CVE-2021-29838 
IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2022-01-26T17:40:14.768Z
CVE-2021-29841 
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205045.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2021-09-14T13:25:27.806Z
CVE-2021-29842 
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
vendor: IBM
product: WebSphere Application Server Liberty
Published: 2021-09-16T15:50:21.807Z
CVE-2021-29843 
IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-11-08T16:50:32.227Z
CVE-2021-29844 
IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Engineering Workflow Management
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2021-10-27T16:00:31.302Z
CVE-2021-29845 
IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2022-01-26T17:40:16.332Z
CVE-2021-29846 
IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 205256.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2022-01-26T17:40:17.678Z
CVE-2021-29847 
BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user to open an insecure communication channel which could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 205267.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Power System S821LC Server (8001-12C)
Published: 2021-12-15T17:05:11.742Z
CVE-2021-29849 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205281.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-12-01T17:05:23.476Z
CVE-2021-29851 
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 205527.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-09-01T16:20:14.084Z
CVE-2021-29852 
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-09-01T16:20:17.759Z
CVE-2021-29853 
IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions. IBM X-Force ID: 205529.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2021-09-01T16:20:19.385Z
CVE-2021-29854 
IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 205680.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2022-05-03T18:20:11.758Z
CVE-2021-29855 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205684.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-10-06T17:10:42.649Z
CVE-2021-29856 
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page. IBM X-Force ID: 205685.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Tivoli Netcool/OMNIbus
Published: 2021-09-20T16:45:58.093Z
CVE-2021-29859 
IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Business Automation
Published: 2022-05-02T16:55:10.569Z
CVE-2021-29860 
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the libc.a library to expose sensitive information. IBM X-Force ID: 206084.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2021-11-17T14:00:14.696Z
CVE-2021-29861 
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sensitive information. IBM X-Force ID: 206085.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2021-11-17T14:00:16.343Z
CVE-2021-29862 
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 206086.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2021-08-26T19:25:29.255Z
CVE-2021-29863 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-12-01T17:05:24.948Z
CVE-2021-29864 
IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 206089
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Identity Manager
Published: 2022-08-30T18:40:09.653Z
CVE-2021-29865 
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 206091.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Jazz Team Server
Published: 2022-06-24T16:15:40.841Z
CVE-2021-29867 
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-12-03T17:00:30.001Z
CVE-2021-29868 
IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: i2 iBase
Published: 2021-10-27T16:05:12.115Z
CVE-2021-29872 
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cloud Pak for Automation
Published: 2022-01-18T16:50:10.770Z
CVE-2021-29873 
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: FlashSystem 900
vendor: IBM
product: FlashSystem V9000
vendor: IBM
product: Storwize V3500
vendor: IBM
product: Storwize V5000
vendor: IBM
product: Storwize V5100
vendor: IBM
product: FlashSystem 9100 Family
vendor: IBM
product: Storwize V3700
vendor: IBM
product: SAN Volume Controller
vendor: IBM
product: Storwize V7000
vendor: IBM
product: Spectrum Virtualize Software
vendor: IBM
product: Spectrum Virtualize for Public Cloud
Published: 2021-10-21T16:40:13.636Z
CVE-2021-29875 
IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access vulnerability. IBM X-Force ID: 206572.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2021-11-02T16:00:30.621Z
CVE-2021-29878 
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Business Automation Workflow
Published: 2021-10-18T16:35:11.354Z
CVE-2021-29880 
IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenants by routing SIEM data to the incorrect domain. IBM X-Force ID: 206979.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2021-08-13T15:50:10.297Z
CVE-2021-29883 
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Transformation Extender Advanced
Published: 2021-10-21T16:40:15.255Z
CVE-2021-29888 
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 207123.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2021-11-02T16:00:32.194Z
CVE-2021-29891 
IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-Force ID: 207221.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Power 9 AC922
Published: 2022-08-22T19:35:10.383Z