CVE-2021-20417

IBM Guardium Data Encryption GDE 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219...

CVE-2021-20417

CVE-2021-20417 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is an information-disclosure flaw where a detailed technical error message returned in the browser could reveal sensitive data to a remote attacker. The IBM Security Bulletin notes this and states the vulnerability has b...

CVE-2021-20416

CVE-2021-20416 affects IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4, where the HTTPOnly flag is not set on cookies, enabling a remote attacker to access sensitive cookie information. The IBM security bulletin notes fixes in GDE 4.0.0.5 and newer; upgrading to that version (or newer) is ...

CVE-2021-20415

IBM Guardium Data Encryption GDE 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217...

CVE-2021-20415

IBM Guardium Data Encryption (GDE) 4.0.0.4 is affected by an inadequate account lockout setting that could let a remote attacker brute-force credentials. The issue is documented under CVE-2021-20415 and is addressed by IBM in a security bulletin that notes fixes in GDE 4.0.0.5 (and newer 5.x seri...

CVE-2021-20379

Summary: CVE-2021-20379 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.3 and 4.0.0.4, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Details in sources: the NVD entry states the cryptographic weakness and impact; IBM...

CVE-2021-20378

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

CVE-2021-20378

CVE-2021-20378 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 . The vulnerability is that GDE does not invalidate sessions after logout, enabling an authenticated user to impersonate another user on the system. Connected sources corroborate the issue in IBM Guardium/GDE a...

CVE-2021-20417: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Encryption GDE 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219...

CVE-2021-20416: Incorrect Permission Assignment for Critical Resource

IBM Guardium Data Encryption GDE 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218...

PT-2021-13928

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE versions 3.0.0.3 through 4.0.0.4 Description: The issue concerns the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations...

PT-2021-13927

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE versions 3.0.0.2 through 4.0.0.4 Description: The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after logout. Recommendations: For versions...

PT-2021-13951

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE versions 3.0.0.3 through 4.0.0.4 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. A remote attacker could...

PT-2021-13950

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE version 4.0.0.4 Description: The issue is related to an inadequate account lockout setting in IBM Guardium Data Encryption GDE, which could allow a remote attacker to brute force account credentials...

PT-2021-13979

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE versions 3.0.0.2 through 4.0.0.4 Description: The issue concerns a lack of authentication for certain functionality that requires a provable user identity or consumes significant resources. Recommendations: Fo...

PT-2021-13952

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE version 4.0.0.4 Description: A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t...

CVE-2021-20379: Use of a Broken or Risky Cryptographic Algorithm

IBM Guardium Data Encryption GDE 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195711...

CVE-2021-20474: Missing Authentication for Critical Function

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources...

CVE-2021-20378: Insufficient Session Expiration

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

CVE-2021-20415: Improper Restriction of Excessive Authentication Attempts

IBM Guardium Data Encryption GDE 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217...