rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-38938 IBM Host Access Transformation Services information disclosure
IBM Host Access Transformation Services (HATS) 9.6 through 9.6.1.4 and 9.7 through 9.7.0.3 stores user credentials in plain clear text which can be read by a local user.  IBM X-Force ID:  210989.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: IBM
product: Host Access Transformation Services
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-03-15T15:38:40.853Z
CVE-2021-38939 
IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2022-04-27T15:20:36.726Z
CVE-2021-38941 
IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information leakage or destruction if unauthorized access to these containers could execute arbitrary commands. IBM X-Force ID: 211048.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Cloud Pak for Multicloud Management Monitoring
Published: 2022-06-30T16:50:16.381Z
CVE-2021-38944 
IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 211236.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2022-05-18T19:30:12.525Z
CVE-2021-38945 
IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-06-24T15:35:24.596Z
CVE-2021-38946 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-04-22T16:30:38.614Z
CVE-2021-38947 
IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 211242.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Copy Data Management
Published: 2021-12-13T17:55:29.539Z
CVE-2021-38948 
IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 211402.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2021-11-02T16:00:33.758Z
CVE-2021-38949 
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ
Published: 2021-11-16T16:55:19.555Z
CVE-2021-38950 
IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ for HPE NonStop
Published: 2021-12-14T16:20:10.693Z
CVE-2021-38951 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 211405.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2021-12-09T17:00:30.662Z
CVE-2021-38952 
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211408.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2022-04-28T16:10:26.902Z
CVE-2021-38954 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version information that could aid in future attacks against the system. IBM X-Force ID: 211414.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2022-06-30T16:50:20.126Z
CVE-2021-38955 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vulnerability in the audit commands. IBM X-Force ID: 211825.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2022-03-01T16:45:24.203Z
CVE-2021-38956 
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks against the system. IBM X-Force ID: 212038
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access
Published: 2022-01-07T17:55:24.652Z
CVE-2021-38957 
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Force ID: 212040.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Access
Published: 2022-01-07T17:55:26.027Z
CVE-2021-38958 
IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Force ID: 212042
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-11-30T16:45:15.183Z
CVE-2021-38959 
IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: SPSS Statistics
Published: 2021-11-17T14:00:17.939Z
CVE-2021-38960 
IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: OPENBMC
vendor: IBM
product: HMC
Published: 2022-02-04T22:33:07.197Z
CVE-2021-38961 
IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: OPENBMC
Published: 2021-12-27T17:10:10.446Z
CVE-2021-38963 IBM Aspera Console CSV injection
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: IBM
product: Aspera Console
cpes: cpe:2.3:a:ibm:aspera_console:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_console:3.4.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-24T10:15:56.981Z
CVE-2021-38965 
IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 212346.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: FileNet Content Manager
Published: 2022-01-17T17:15:12.165Z
CVE-2021-38966 
IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Automation
Published: 2021-12-21T19:10:17.506Z
CVE-2021-38967 
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-11-30T16:45:16.628Z
CVE-2021-38969 
IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Virtualize
Published: 2022-05-11T16:10:13.363Z
CVE-2021-38971 
IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking rules and obtain sensitve information. IBM X-Force ID: 212620.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Data Virtualization on Cloud Pak for Data
Published: 2022-03-14T17:00:21.310Z
CVE-2021-38972 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-12T15:20:22.326Z
CVE-2021-38973 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-12T15:20:23.937Z
CVE-2021-38974 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:30.342Z
CVE-2021-38975 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 212780.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:32.016Z
CVE-2021-38976 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:33.620Z
CVE-2021-38977 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:35.224Z
CVE-2021-38978 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 212783.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:36.823Z
CVE-2021-38979 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:38.410Z
CVE-2021-38980 
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212786.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-23T19:15:36.395Z
CVE-2021-38981 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212788.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:40.041Z
CVE-2021-38982 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:41.616Z
CVE-2021-38983 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 212792.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:43.197Z
CVE-2021-38984 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 212793.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-15T15:35:44.782Z
CVE-2021-38985 
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Key Lifecycle Manager
Published: 2021-11-12T15:20:25.503Z
CVE-2021-38986 
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: MQ Appliance
Published: 2022-03-01T16:45:25.622Z
CVE-2021-38988 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212950.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2022-03-07T16:55:14.019Z
CVE-2021-38989 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212951.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2022-03-07T16:55:15.684Z
CVE-2021-38990 
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM X-Force ID: 212952.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-01-07T17:55:27.439Z
CVE-2021-38991 
IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution. IBM X-Force ID: 212953.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-01-11T16:25:18.300Z
CVE-2021-38993 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. IBM X-Force ID: 212962.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2022-02-25T18:00:11.336Z
CVE-2021-38994 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213072.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-02-24T17:05:12.368Z
CVE-2021-38995 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213073.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-02-24T17:05:19.828Z
CVE-2021-38996 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213076.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: VIOS
vendor: IBM
product: AIX
Published: 2022-03-02T16:35:15.526Z
CVE-2021-38997 IBM API Connect HOST header injection
IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  213212.
Problem types: cwe_id: CWE-644
description: CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: IBM
product: API Connect
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-12-01T17:00:59.602Z
CVE-2021-38999 
IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-11-30T16:45:18.129Z
CVE-2021-39000 
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ Appliance
Published: 2021-11-30T16:45:19.481Z
CVE-2021-39002 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2021-12-09T17:00:32.094Z
CVE-2021-39006 
IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. IBM X-Force ID: 213549.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar WinCollect Agent
Published: 2022-06-21T16:00:18.209Z
CVE-2021-39008 IBM QRadar WinCollect Agent information disclosure

IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices. IBM X-Force ID: 213551.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: QRadar WinCollect Agent
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-11-23T22:54:52.377Z
CVE-2021-39009 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-09-01T19:00:27.281Z
CVE-2021-39011 IBM Cloud Pak for Security information disclosure

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.


Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-01-20T18:08:10.000Z
CVE-2021-39013 
IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2021-12-22T16:50:09.950Z