rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4072 Log Forging in generator-jhipster-kotlin
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: jhipster
product: jhipster-kotlin
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2020-06-25T20:05:15.000Z
CVE-2020-4074 Improper Authentication
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: PrestaShop
product: PrestaShop
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Published: 2020-07-02T17:05:25.000Z
CVE-2020-4075 Arbitrary file read via window-open IPC in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Problem types: cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: electron
product: electron
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-07-07T00:05:28.000Z
CVE-2020-4076 Context isolation bypass via leaked cross-context objects in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Problem types: cwe_id: CWE-501
description: CWE-501 Trust Boundary Violation
Affected products: vendor: electron
product: electron
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2020-07-07T00:05:21.000Z
CVE-2020-4077 Context isolation bypass via contextBridge in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Problem types: cwe_id: CWE-501
description: CWE-501 Trust Boundary Violation
Affected products: vendor: electron
product: electron
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2020-07-07T00:05:16.000Z
CVE-2020-4079 Information disclosure vulnerability in iTop
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Combodo
product: iTop
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2021-01-12T19:20:14.000Z
CVE-2020-4080 
HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: HCL Verse
Published: 2020-12-18T21:14:49.000Z
CVE-2020-4081 
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
Problem types: description: "Cross-site scripting"
Affected products: vendor: n/a
product: HCL Digital Experience
Published: 2021-02-02T20:08:48.000Z
CVE-2020-4082 
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Problem types: description: Cross-Site Scripting
Affected products: vendor: HCL Software
product: "HCL Connections"
Published: 2020-03-05T18:45:23.000Z
CVE-2020-4083 
HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
Problem types: description: Path Disclosure
Affected products: vendor: HCL Software
product: "HCL Connections"
Published: 2020-03-05T18:39:40.000Z
CVE-2020-4084 
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: HCL Software
product: HCL Connections
Published: 2020-03-09T16:42:54.000Z
CVE-2020-4085 
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."
Problem types: description: "Information Disclosure"
Affected products: vendor: n/a
product: "HCL Connections"
Published: 2020-04-22T14:53:48.000Z
CVE-2020-4089 
HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.
Problem types: description: "Information Leakage"
Affected products: vendor: HCL
product: HCL Notes
Published: 2020-06-26T22:55:30.000Z
CVE-2020-4092 
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
Problem types: description: "Sensitive Information Exposure"
Affected products: vendor: n/a
product: "HCL Nomad"
Published: 2020-05-06T12:30:48.000Z
CVE-2020-4095 
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
Problem types: description: "Clear text credentials"
Affected products: vendor: n/a
product: "HCL BigFix Platform"
Published: 2020-07-16T18:27:41.000Z
CVE-2020-4097 
In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 previous to 11.0.1 FixPack 1, a vulnerability in the input parameter handling of the Notes Client could potentially be exploited by an attacker resulting in a buffer overflow. This could enable an attacker to crash HCL Notes or execute attacker-controlled code on the client.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-11-05T16:45:02.000Z
CVE-2020-4099 HCL Verse for Android is susceptible to an APK signing key check vulnerability
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: HCL Software
product: HCL Verse for Android
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
Published: 2022-11-01T17:55:10.519Z
CVE-2020-4100 
"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime; however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (for example, a non-invasive update feature), it can also open the application to loading unintended code if not implemented properly."
Problem types: description: "Dynamic code loading/injection"
Affected products: vendor: n/a
product: "HCL Verse for Android"
Published: 2020-07-15T12:31:11.000Z
CVE-2020-4101 
"HCL Digital Experience is susceptible to Server Side Request Forgery."
Problem types: description: "Server-side request forgery"
Affected products: vendor: n/a
product: "HCL Digital Experience"
Published: 2020-06-11T13:20:13.000Z
CVE-2020-4102 
HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Notes or execute attacker-controlled code on the client system.
Problem types: description: "Buffer overflow"
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-12-02T00:56:42.000Z
CVE-2020-4104 
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.
Problem types: description: "Cross-site scripting"
Affected products: vendor: HCL
product: HCL BigFix WebUI
Published: 2020-07-17T20:46:39.000Z
CVE-2020-4107 HCL Domino is affected by an Insufficient Access Control vulnerability
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: HCL Software
product: HCL Domino
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-05-19T21:25:10.514Z
CVE-2020-4125 
Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information.
Problem types: description: "Sensitive data exposure"
Affected products: vendor: n/a
product: "HCL Marketing Operations"
Published: 2020-07-20T21:52:17.000Z
CVE-2020-4126 
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
Problem types: description: Sensitive cookie exposure
Affected products: vendor: n/a
product: HCL iNotes
Published: 2020-11-30T23:50:09.000Z
CVE-2020-4127 
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
Problem types: description: Login CSRF vulnerability
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-11-30T21:41:53.000Z
CVE-2020-4128 
HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service.
Problem types: description: "Lockout policy bypass "
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-12-01T13:12:37.000Z
CVE-2020-4129 
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
Problem types: description: Lockout policy bypass
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-11-30T23:46:22.000Z
CVE-2020-4135 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-02-19T15:15:45.454Z
CVE-2020-4138 
IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security SiteProtector System
Published: 2022-07-11T17:05:12.862Z
CVE-2020-4140 
IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174052.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security SiteProtector System
Published: 2021-11-12T15:20:19.203Z
CVE-2020-4146 
IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 174129.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security SiteProtector System
Published: 2021-11-12T15:20:20.714Z
CVE-2020-4150 
IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174142.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security SiteProtector System
Published: 2022-07-11T17:05:17.208Z
CVE-2020-4151 
IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. IBM X-Force ID: 174201.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-04-14T15:10:11.351Z
CVE-2020-4152 
IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can be obtained using man in the middle techniques. IBM X-Force ID: 17467.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Network Security
Published: 2021-11-08T16:50:26.091Z
CVE-2020-4153 
IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174269.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar Network Security
Published: 2021-11-08T16:50:27.630Z
CVE-2020-4157 
IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174337.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Network Security
Published: 2022-07-12T17:35:18.668Z
CVE-2020-4159 
IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Network Security
Published: 2022-07-12T17:35:20.309Z
CVE-2020-4160 
IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 174340.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Network Security
Published: 2021-11-08T16:50:29.152Z
CVE-2020-4161 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-02-19T15:15:45.862Z
CVE-2020-4162 
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174342.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-03-10T11:55:16.221Z
CVE-2020-4163 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-02-04T16:45:38.204Z
CVE-2020-4164 
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Information Queue
Published: 2020-04-08T14:05:44.017Z
CVE-2020-4165 
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 174401.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-24T15:30:29.790Z
CVE-2020-4166 
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 174402.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-27T12:40:31.259Z
CVE-2020-4167 
IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechanisms. IBM X-Force ID: 174403.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-27T12:40:31.738Z
CVE-2020-4169 
IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174405.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-27T12:40:32.228Z
CVE-2020-4170 
IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-24T15:30:30.264Z
CVE-2020-4171 
IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-27T12:40:32.665Z
CVE-2020-4172 
IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 174408.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Guardium Insights
Published: 2020-08-27T12:40:33.156Z