CVE-2019-4292

CVE-2019-4292 affects IBM Security Guardium (notably version 10.5; IBM’s bulletins also list 9.0–9.5, 10.5, 10.6, 11.0 as affected). The vulnerability allows a remote attacker to upload arbitrary files, enabling potential arbitrary code execution on the vulnerable web server. Remediation in IBM a...

PT-2019-16869 · Ibm · Db2

Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description: The issue allows a malicious user with access to the DB2 instance account to leverage a fenced execution process and execute...

CVE-2019-12044

A Buffer Overflow exists in Citrix NetScaler Gateway 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23 and Citrix Application Delivery Controller 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before...

CVE-2019-1837

A vulnerability in the User Data Services UDS API of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the management GUI. The vulnerability is due to improper validation of input parameters in the UDS API...

Stack overflow

IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 153316...

PT-2019-16844 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description: The issue is a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root...

Default configuration

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

CVE-2019-1672 Cisco Web Security Appliance Decryption Policy Bypass Vulnerability

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

Security Bulletin: IBM Security Guardium is affected by a Improper Certificate Validation vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1509 DESCRIPTION: IBM Security Guardium EcoSystem does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a...

Security Bulletin: IBM Security Guardium is affected by a Using Components (microcode_ctl) with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-5715 DESCRIPTION: Intel Haswell Xeon, AMD PRO and ARM Cortex A57 CPUs could allow a local authenticated attacker to obtain sensitive information, caused by a branch target injection in...

CVE-2018-1889

IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080...

CVE-2018-1889

IBM Security Guardium 10.0–10.5 are affected by a cross-site scripting vulnerability in the Web UI that lets an attacker inject arbitrary JavaScript, potentially exposing credentials within a trusted session. Root cause: XSS in the user interface. Affected versions: Guardium 10.0–10.5. CVSSv3 bas...

CVE-2017-1265

IBM Security Guardium versions 10.0–10.5 contain an improper certificate validation flaw that can enable MITM-style spoofing of trusted entities. The issue affects the Guardium service components that handle certificate validation, enabling an attacker to present forged certificates under network...

IBM Security Guardium Cross-Site Scripting Vulnerability (CNVD-2018-26033)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A cross-site scripting vulnerability exists in IBM Security Guardium...

Security Bulletin: IBM Security Guardium is affected by an Improper Certificate Validation vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1509 DESCRIPTION: IBM Security Guardium EcoSystem does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a...

Security Bulletin: IBM Security Guardium is affected by a Improper Certificate Validation vulnerability

Summary IBM Security Guardium has addressed the following vulnerability Vulnerability Details CVEID: CVE-2017-1265 DESCRIPTION: IBM Security Guardium does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by using a...

CVE-2018-1817

IBM Security Guardium 10.0–10.5 is vulnerable to cross-site scripting in the Web UI, allowing an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The root cause is a Web UI input handling issue (CVE-2018-1817). A remediation is available: upgr...

CVE-2017-1268

IBM Security Guardium versions 10.0–10.5 are affected by CVE-2017-1268 due to using a single cryptographic hash without salt, enabling potential information disclosure. The IBM security bulletin lists remediation by upgrading to a fixed release (10.6, e.g., SqlGuard_10.0p600_GPU_Nov-2018-V10.6). ...

openSUSE Security Update : postgresql10 (openSUSE-2018-1148)

This update for brings postgresql10 version 10.5 to openSUSE Leap 42.3. FATE325659 bnc1108308 This release marks the change of the versioning scheme for PostgreSQL to a 'x.y' format. This means the next minor releases of PostgreSQL will be 10.1, 10.2, ... and the next major release will be 11. -...

IBM Security Guardium Man-in-the-Middle Attack Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardium version 10.5...