CVE-2019-4697

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938...

CVE-2019-4686

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4713

CVE-2019-4713 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2. A remote authenticated attacker could send a specially crafted request to execute arbitrary commands on the system. Public sources confirm the flaw and its impact (high CWE/CVSS), with IBM providing a fixed version in GDE ...

CVE-2019-4701

CVE-2019-4701 concerns IBM Guardium Data Encryption (GDE) 3.0.0.2, where active debugging code can create unintended entry points. Connected sources (CNVD-2020-50543) describe a cross-site scripting vulnerability in GDE 3.0.0.2 related to this issue, attributed to an unintended debugger entry. Th...

CVE-2019-4713

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084...

CVE-2019-4694

CVE-2019-4694 involves IBM Guardium Data Encryption (GDE) 3.0.0.2, which contains hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. The underlying risk is credential exposure within the product, as described in the CVE record and corrobor...

CVE-2019-4697

Summary (grounded): CVE-2019-4697 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where user credentials are stored in plaintext and readable by an authenticated user. The vulnerability stems from plaintext storage in GDE 3.0.0.2, enabling credential disclosure. The IBM/IBM X-Force and CNVD/N...

CVE-2019-4692

CVE-2019-4692 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where sensitive information is disclosed to unauthorized users. The vulnerability is an information disclosure flaw that could enable attackers to obtain data and potentially mount further attacks. Affected product: GDE 3.0.0.2. Un...

CVE-2019-4691

CVE-2019-4691 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2, with a cross-site scripting flaw that can embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session. Remediation: upgrade to GDE 4.0.0.3 (fixes noted in IBM bulletin). CVSSv3 base s...

CVE-2019-4689

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Security Bulletin: IBM InfoSphere BigInsights affected by multiple vulnerabilities in alert module (CVE-2014-4781, CVE-2014-4782)

Summary Security vulnerabilities have been identified in the alert module of InfoSphere BigInsights that could allow an attacker to obtain information from the Alert management services. Vulnerability Details CVE-ID: CVE-2014-4781 DESCRIPTION: IBM InfoSphere BigInsights could allow an attacker to...

IBM Security Key Lifecycle Manager Weak Encryption Algorithm Vulnerability

IBM Security Key Lifecycle Manager centralizes, simplifies and automates the encryption key management process, helping to minimize the risks and operational costs of encryption key management. A weak cryptographic algorithm vulnerability exists in IBM Security Key Lifecycle Manager 3.0 - 3.0.0.2...