rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-4270 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160203.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-17T19:05:23.928Z
CVE-2019-4271 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-17T19:05:23.980Z
CVE-2019-4275 
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could cause a denial of service. IBM X-Force ID: 160296.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2019-08-02T14:10:12.795Z
CVE-2019-4279 
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-05-17T15:20:16.803Z
CVE-2019-4280 
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2019-09-30T15:20:31.101Z
CVE-2019-4284 
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Private
Published: 2019-08-05T13:40:15.577Z
CVE-2019-4285 
IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch other client-side browser attacks. IBM X-Force ID: 160513.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-07-30T13:25:14.902Z
CVE-2019-4286 
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160514.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2020-04-29T13:45:15.082Z
CVE-2019-4288 
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160631.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2020-04-29T13:45:15.501Z
CVE-2019-4291 
IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 160697.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2022-02-16T17:00:15.604Z
CVE-2019-4292 
IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable web server. IBM X-Force ID: 160698.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium
Published: 2019-07-02T15:05:23.340Z
CVE-2019-4293 
IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Storwize V7000 Unified (2073)
Published: 2019-05-20T17:25:23.468Z
CVE-2019-4294 
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ Appliance
vendor: IBM
product: DataPower Gateway
Published: 2019-08-20T18:25:26.483Z
CVE-2019-4295 
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:37.883Z
CVE-2019-4296 
IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:37.940Z
CVE-2019-4297 
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:37.995Z
CVE-2019-4298 
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:38.050Z
CVE-2019-4299 
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:38.117Z
CVE-2019-4301 
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.
Problem types: description: Arbitrary code execution
Affected products: vendor: IBM Corporation
product: HCL BigFix Self-Service Application (SSA)
Published: 2020-02-28T21:05:15.000Z
CVE-2019-4303 
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2019-06-19T13:30:19.709Z
CVE-2019-4304 
IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-30T15:20:31.527Z
CVE-2019-4305 
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2019-09-30T15:20:31.961Z
CVE-2019-4306 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security-critical resource which could lead to the exposure of sensitive information or the modification of that resource by unintended parties. IBM X-Force ID: 160986.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:07.863Z
CVE-2019-4307 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:08.303Z
CVE-2019-4308 
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Emptoris Sourcing
vendor: IBM
product: Contract Management
vendor: IBM
product: Emptoris Spend Analysis
Published: 2019-08-20T18:25:26.552Z
CVE-2019-4309 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM X-Force ID: 161035.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:08.786Z
CVE-2019-4310 
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-08-20T18:25:26.611Z
CVE-2019-4311 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 161037.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:09.271Z
CVE-2019-4314 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:09.751Z
CVE-2019-4321 
IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 161201.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Intelligent Operations Center
Published: 2019-09-05T14:50:15.636Z
CVE-2019-4322 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 161202.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-07-01T15:05:38.166Z
CVE-2019-4323 
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
Problem types: description: "Clickjacking"
Affected products: vendor: n/a
product: "HCL AppScan Enterprise"
Published: 2020-07-07T14:49:46.000Z
CVE-2019-4324 
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
Problem types: description: "Cross-site scripting"
Affected products: vendor: n/a
product: "HCL AppScan Enterprise"
Published: 2020-07-07T14:45:17.000Z
CVE-2019-4325 
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."
Problem types: description: "Security Misconfiguration"
Affected products: vendor: n/a
product: "HCL AppScan Enterprise "
Published: 2020-10-06T17:18:43.000Z
CVE-2019-4326 
"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."
Problem types: description: "Security Misconfiguration"
Affected products: vendor: n/a
product: "HCL AppScan Enterprise "
Published: 2020-10-06T17:22:45.000Z
CVE-2019-4327 
"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."
Problem types: description: "Broken authentication"
Affected products: vendor: n/a
product: "HCL AppScan Enterprise Edition"
Published: 2020-04-21T18:13:45.000Z
CVE-2019-4329 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:10.249Z
CVE-2019-4330 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:10.730Z
CVE-2019-4334 
IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2019-11-09T01:41:07.261Z
CVE-2019-4335 
IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Watson Studio Local
Published: 2019-12-30T15:35:21.315Z
CVE-2019-4336 
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:38.219Z
CVE-2019-4337 
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation with Automation Anywhere
Published: 2019-07-01T15:05:38.271Z
CVE-2019-4338 
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-08-20T19:30:25.480Z
CVE-2019-4339 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 161418.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-10-28T23:36:11.155Z
CVE-2019-4340 
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 161419.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Big Data Intelligence
Published: 2019-08-20T19:30:25.528Z
CVE-2019-4342 
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 161421.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2019-09-17T19:05:24.031Z
CVE-2019-4343 
IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An attacker could exploit this vulnerability to access content that should be restricted. IBM X-Force ID: 161422.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2019-12-30T15:35:21.805Z
CVE-2019-4349 
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the confidentiality and integrity of the service. IBM X-Force ID: 161486
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2020-11-03T13:25:20.872Z
CVE-2019-4351 
IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2022-02-16T17:00:17.556Z
CVE-2019-4352 
IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Anywhere
Published: 2022-02-16T17:00:19.529Z
CVE-2019-4357 
When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2019-07-01T15:05:38.323Z
CVE-2019-4364 
IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2019-06-19T13:30:19.753Z
CVE-2019-4366 
IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM X-Force ID: 161748.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2020-08-03T12:35:36.114Z
CVE-2019-4377 
IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2019-06-25T15:45:30.240Z
CVE-2019-4378 
IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is vulnerable to a denial of service attack caused by an authenticated and authorized user using specially crafted PCF messages. IBM X-Force ID: 162084.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2019-09-26T15:05:31.039Z
CVE-2019-4381 
IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API to interface with the HMC. An attacker could exploit this vulnerability to obtain HMC credentials. IBM X-Force ID: 162159.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: i
Published: 2019-06-14T14:45:18.068Z
CVE-2019-4382 
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2019-06-25T15:45:30.286Z
CVE-2019-4383 
When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user privileges. IBM X-Force ID: 162165.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2019-07-01T15:05:38.380Z
CVE-2019-4384 
IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162172.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Campaign
Published: 2019-06-19T13:30:19.794Z
CVE-2019-4385 
IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2019-06-19T13:30:19.838Z
CVE-2019-4386 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2019-07-01T15:05:38.433Z
CVE-2019-4387 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 162715.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2019-11-26T15:46:18.539Z
CVE-2019-4388 
HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.
Problem types: description: Cross-Site Scripting
Affected products: vendor: HCL
product: AppScan Source
Published: 2019-12-18T12:57:27.000Z
CVE-2019-4391 
HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
Problem types: description: "XML External Entity Injection"
Affected products: vendor: n/a
product: HCL AppScan Standard Edition
Published: 2020-04-07T15:12:23.000Z