CVE-2023-47707: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2023-47705: Improper Input Validation

IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228...

CVE-2023-47706: Unrestricted Upload of File with Dangerous Type

IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341...

CVE-2023-47703: Generation of Error Message Containing Sensitive Information

IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197...

CVE-2023-47704: Use of Hard-coded Credentials

IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220...

Security Bulletin: IBM Security Guardium is affected by a guava-18.0.jar vulnerability (CVE-2023-2976)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:CVE-2023-2976 DESCRIPTION: Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw with using Java's default temporary directory for file creation in...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities. [CVE-2022-42889, CVE-2023-35001, CVE-2023-32233]

Summary IBM Security Guardium has addressed the following vulnerabilities with the update recommended below in the remediation / fix section. Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: OX AppSuite could allow a remote attacker to execute arbitrary code on the system, caused by a flaw...

Security Bulletin: IBM Security Guardium is affected by an Apache Struts vulnerability ( CVE-2023-34396)

Summary IBM Security Guardium has addressed this vulnerability with an update. Vulnerability Details CVEID:CVE-2023-34396 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw when processing Multipart request containing non-file normal form fields. By sending a...

Security Bulletin: IBM Security Guardium is affected by a denial of service vulnerability in Apache Struts (CVE-2023-34149)

Summary IBM Security Guardium has addressed this vulnerability with an update. Vulnerability Details CVEID:CVE-2023-34149 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw with only handling setProperty but not getProperty. By sending a specially crafted request, a...

IBM Security Guardium Cross-Site Scripting Vulnerability

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management, and streamlined audit process building. A cross-site scripting vulnerability exists in IBM...

IBM Security Guardium Code Issue Vulnerability

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management, and streamlined audit process building. A code issue vulnerability exists in IBM Security...

IBM Security Guardium 输入验证错误漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. An input validation error vulnerability exists in IBM...

IBM Security Guardium Security Vulnerabilities

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customized UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardiu...

PT-2023-30578

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Key Lifecycle Manager version 4.3 Description The issue allows an authenticated user to manipulate username data due to improper input validation. Recommendations For IBM Security Guardium Key Lifecycle Manager version 4....

PT-2023-30575

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Key Lifecycle Manager version 4.3 Description The issue allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing dot dot sequences ../ to view or...

PT-2023-30576

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Key Lifecycle Manager version 4.3 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in furthe...

IBM Security Guardium 路径遍历漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A path traversal vulnerability exists in IBM Security...

PT-2023-30579

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Key Lifecycle Manager version 4.3 Description The issue allows an authenticated user to upload files of a dangerous file type. Recommendations For IBM Security Guardium Key Lifecycle Manager version 4.3, consider...

Security Bulletin: IBM Security Guardium is affected by a snowflake-jdbc-3.13.8.jar vulnerability (CVE-2023-30535)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:CVE-2023-30535 DESCRIPTION: Snowflake Computing Snowflake JDBC could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the SSO URL...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Oracle MySQL Server

Summary IBM Security Guardium has released an update to address these vulnerabilities. Vulnerability Details CVEID:CVE-2023-21940 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Components Services component could allow a remote authenticated attacker to...