rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-4315 
IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 177234.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Business Automation Content Analyzer on Cloud
Published: 2020-09-21T14:55:23.372Z
CVE-2020-4316 
IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 177354.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Publishing Engine
Published: 2020-07-16T15:05:35.295Z
CVE-2020-4317 
IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177355.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Intelligent Operations Center
vendor: IBM
product: Water Operations for Waternamics
vendor: IBM
product: Intelligent Operations Center for Emergency Management
Published: 2020-07-28T12:05:25.765Z
CVE-2020-4318 
IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177356.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Intelligent Operations Center for Emergency Management
vendor: IBM
product: Water Operations for Waternamics
vendor: IBM
product: Intelligent Operations Center
Published: 2020-07-28T12:05:26.224Z
CVE-2020-4319 
IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ Appliance
Published: 2020-07-28T12:05:26.710Z
CVE-2020-4320 
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2020-06-16T13:45:21.961Z
CVE-2020-4322 
IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 177511.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-06-24T14:10:20.837Z
CVE-2020-4323 
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177514.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-06-24T14:10:21.266Z
CVE-2020-4324 
IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID: 177515.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-09-23T13:45:16.376Z
CVE-2020-4325 
The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a consequence, the Java Virtual Machine can't recover the memory used by those thread pools, which leads to an OutOfMemory exception when the Process Federation Server Global Teams REST API is used extensively. IBM X-Force ID: 177596.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Process Federation Server
vendor: IBM
product: Automation Workstream Services in Cloud Pak for Automation
Published: 2020-04-02T14:20:22.033Z
CVE-2020-4327 
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 177599.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-06-24T14:10:21.695Z
CVE-2020-4328 
IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 177839.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2020-08-03T12:35:37.210Z
CVE-2020-4329 
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID: 177841.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server Liberty
vendor: IBM
product: WebSphere Application Server
Published: 2020-04-28T13:30:15.230Z
CVE-2020-4336 
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 177932.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere eXtreme Scale
Published: 2021-01-06T13:10:14.732Z
CVE-2020-4337 
IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the server to generate user registration emails that contain malicious URLs. IBM X-Force ID: 177933.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: API Connect
Published: 2020-09-03T13:55:20.454Z
CVE-2020-4338 
IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. IBM X-Force ID: 177937.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ
Published: 2020-04-16T15:35:21.704Z
CVE-2020-4340 
IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-09-23T13:45:17.061Z
CVE-2020-4341 
IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178181.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-06-24T14:10:22.124Z
CVE-2020-4342 
IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Secret Server
Published: 2020-06-24T14:10:22.599Z
CVE-2020-4343 
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 178244.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: i2 Analysts Notebook
Published: 2020-05-14T15:50:45.096Z
CVE-2020-4344 
IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Tivoli Business Service Manager
Published: 2020-09-15T13:50:23.669Z
CVE-2020-4345 
IBM i 7.2, 7.3, and 7.4 users running complex SQL statements under a specific set of circumstances may allow a local user to obtain sensitive information that they should not have access to. IBM X-Force ID: 178318.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: i
Published: 2020-05-17T14:00:18.053Z
CVE-2020-4346 
IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: API Connect
Published: 2020-05-12T13:40:17.772Z
CVE-2020-4347 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could be subject to attacks based on privilege escalation due to inappropriate file permissions for files used by WebSphere Application Server Network Deployment. IBM X-Force ID: 178412.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-04-16T15:35:22.185Z
CVE-2020-4348 
IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:28.309Z
CVE-2020-4349 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178423.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:28.747Z
CVE-2020-4350 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:29.238Z
CVE-2020-4352 
IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IBM X-Force ID: 178427.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ for HPE NonStop
Published: 2020-05-29T13:10:20.156Z
CVE-2020-4353 
IBM MaaS360 6.82 could allow a user with pysical access to the device to crash the application which may enable the user to access restricted applications and device settings. IBM X-Force ID: 178505.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MaaS360
Published: 2020-04-23T13:10:24.388Z
CVE-2020-4354 
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178506.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2021-05-31T15:10:43.266Z
CVE-2020-4355 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper handling of Secure Sockets Layer (SSL) renegotiation requests. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to increase the resource usage on the system. IBM X-Force ID: 178507.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-07-01T14:25:30.996Z
CVE-2020-4357 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:29.671Z
CVE-2020-4358 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178762.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:30.124Z
CVE-2020-4360 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2020-06-02T13:45:22.062Z
CVE-2020-4361 
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics
Published: 2020-07-20T14:05:24.178Z
CVE-2020-4362 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-04-10T14:00:17.550Z
CVE-2020-4363 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 178960.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-07-01T14:25:31.439Z
CVE-2020-4364 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178961.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2020-07-14T13:10:19.627Z
CVE-2020-4365 
IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2020-05-14T15:50:45.541Z
CVE-2020-4366 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178965.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2020-06-02T13:45:22.494Z
CVE-2020-4367 
IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179001.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2020-06-02T13:45:22.931Z
CVE-2020-4369 
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Verify Gateway (IVG)
Published: 2020-07-22T20:30:34.495Z
CVE-2020-4371 
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Verify Gateway (IVG)
Published: 2020-07-22T20:30:34.933Z
CVE-2020-4372 
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Verify Gateway (IVG)
Published: 2020-07-22T20:30:35.376Z
CVE-2020-4375 
IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by an error creating a dynamic queue. IBM X-Force ID: 179080.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2020-07-28T12:05:27.198Z
CVE-2020-4376 
IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error within the pubsub logic. IBM X-Force ID: 179081.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ for HPE NonStop
Published: 2020-07-01T14:25:31.874Z
CVE-2020-4377 
IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2020-08-03T12:35:37.675Z
CVE-2020-4378 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:30.575Z
CVE-2020-4379 
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2020-05-27T13:15:31.065Z
CVE-2020-4380 
IBM Workload Scheduler 9.3.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179160.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Workload Scheduler
Published: 2020-06-11T12:10:12.062Z
CVE-2020-4381 
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Elastic Storage Server
Published: 2020-08-19T12:35:18.025Z
CVE-2020-4382 
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgrade pertaining to xcat services. IBM X-Force ID: 179163.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Elastic Storage Server
Published: 2020-08-24T15:30:30.747Z
CVE-2020-4383 
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while configuring some of the network services. IBM X-Force ID: 179165.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Elastic Storage Server
Published: 2020-08-24T15:30:31.164Z
CVE-2020-4384 
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179265.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2020-05-06T13:45:18.686Z
CVE-2020-4385 
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 179266.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Verify Gateway (IVG)
Published: 2020-07-22T20:30:35.865Z
CVE-2020-4386 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-07-01T14:25:32.319Z
CVE-2020-4387 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux- UNIX and Windows
Published: 2020-07-01T14:25:32.753Z
CVE-2020-4388 
IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used in future attacks. IBM X-Force ID: 179270.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2020-10-12T13:20:29.066Z
CVE-2020-4395 
IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Access Manager Appliance
Published: 2020-10-14T16:35:14.835Z