3510 matches found
CVE-2023-25688: Improper Limitation of a Pathname to a Restricted Directory
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 247606...
CVE-2023-25686: Insufficiently Protected Credentials
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601...
CVE-2023-25923: Incorrect Authorization
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629...
CVE-2023-25689: Improper Limitation of a Pathname to a Restricted Directory
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 24761...
CVE-2023-25924: Incorrect Authorization
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630...
CVE-2023-25687: Generation of Error Message Containing Sensitive Information
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602...
PT-2023-20363
Name of the Vulnerable Software and Affected Versions IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description The issue is related to improper authorization, allowing an authenticated user to perform actions they should not have access to. Recommendations For versions 3...
IBM Security Guardium SQL注入漏洞
IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management, and streamlined audit process construction.IBM Security Guardium Key Lifecycle Manager is vulnerab...
Security Bulletin: Multiple Vulnerabilities in IBM Security Guardium Key Lifecycle Manager (CVE-2023-25921, CVE-2023-25926, CVE-2023-25685, CVE-2023-25922, CVE-2023-25925)
Summary There are multiple vulnerabilities identified in IBM Security Guardium Key Lifecycle Manager. These vulnerabilties have been fixed in IBM Security Guardium Key Lifecycle Manager v4.2 and v4.1.1.7. Please upgrade to GKLM v4.2 or apply the latest fix packs 4.1.1 FP 7 for the fixes...
Security Bulletin: IBM Security Guardium is affected by the following vulnerabilities [CVE-2022-39166, CVE-2022-34917, CVE-2022-42889]
Summary IBM Security Guardium has addressed these vulnerabilities CVE-2022-39166, CVE-2022-34917, CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-39166 DESCRIPTION: IBM Security Guardium could allow a privileged user to obtain sensitive information inside of an HTTP response. CVSS Base score:...
Security Bulletin: IBM Security Guardium is affected by an out-of-bounds access issue vulnerability (CVE-2022-2319, CVE-2022-2320)
Summary IBM Security Guardium has fixed this vulnerability. Vulnerability Details CVEID:CVE-2022-2319 DESCRIPTION: X.Org Server could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds access in ProcXkbSetGeometry. By sending a...
Security Bulletin: IBM Security Guardium is affected by a redshift-jdbc42-2.0.0.3.jar vulnerability (CVE-2022-41828)
Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:CVE-2022-41828 DESCRIPTION: Amazon AWS Redshift JDBC Driver could provide weaker than expected security, caused by failing to heck the class type when instantiating an object from a class name in Object Factory...
Security Bulletin: Security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager (CVE-2022-22389, CVE-2022-25313, CVE-2022-25236, CVE-2022-25314, CVE-2022-25315, CVE-2022-25235 and CVE-2022-22390)
Summary IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
Security Bulletin: IBM Security Guardium Data Encryption is using Components with Known Vulnerabilities (CVE-2022-31129, CVE-2022-24785)
Summary IBM Security Guardium Data Encryption is using components with known vulnerabilities. Please upgrade to latest version of CT-VL having the fixes. Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficient regular expression...
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2023-23477)
Summary WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed...
Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Oracle® MySQL
Summary IBM Security Guardium has addressed these vulnerabilities by updating the affected component. Vulnerability Details CVEID:CVE-2022-21538 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Security: Encryption component could allow an authenticated...
Security Bulletin: IBM Security Guardium is affected by a denial of service vulnerability (CVE-2022-25647)
Summary IBM Security Guardium has fixed this vulnerability. Please update your product as detailed below. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace method, a...
IBM Security Guardium Information Disclosure Vulnerability (CNVD-2022-91128)
IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building.IBM Security Guardium 11.4 is vulnerable to informatio...
