Security Bulletin: IBM Security Guardium is affected by a Password in Clear Text vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1498 DESCRIPTION: IBM Security Guardium EcoSystem stores user credentials in plain in clear text which can be read by a local user. CVSS Base Score: 6.2 CVSS Temporal Score: See for the...

Security Bulletin: IBM Security Guardium is affected by a Publicly disclosed Apache Struts vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-11776 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an error when using results with no namespace and its upper action...

Security Bulletin: IBM Security Guardium is affected by a Public disclosed vulnerability from Bouncy Castle

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-13098 DESCRIPTION: Bouncy Castle could allow a remote attacker to obtain sensitive information, caused by an RSA Adaptive Chosen Ciphertext Bleichenbacher attack. By utilizing...

Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2015-8100 DESCRIPTION: OpenBSD could allow a local attacker to obtain sensitive information, caused by the use of 0644 permissions for snmpd.conf by the net-snmp package. By reading the fil...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium. These issues were disclosed as part of the IBM Java SDK updates in Jan 2018. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction

Summary There are multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2814 DESCRIPTION: An unspecified vulnerability related to the Java SE VM...

Security Bulletin: Vulnerabilities in Bash affect IBM InfoSphere Guardium Database Activity Monitoring (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM InfoSphere Guardium Database Activity Monitoring. Vulnerability...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Guardium Data Redaction (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Guardium Data Redaction. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM InfoSphere Guardium (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM InfoSphere Guardium. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: IBM InfoSphere Guardium System x/Flex Systems appliances are affected by vulnerabilities in OpenSSL: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL, that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients a...

Security Bulletin: IBM InfoSphere Guardium Database Activity Monitor is affected by CVE-2014-0221, CVE-2014-0224, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470

Summary Guardium appliance is RHEL 5.8 based and uses OpenSSL from Red Hat for communications between appliances. Vulnerability Details CVE-2014-0224 OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker...

Security Bulletin: IBM InfoSphere Guardium Database Activity Monitor is affected by: CVE-2014-4263 and CVE-2014-4244

Summary An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact, reported on July 15, 2014. Vulnerability Details CVE-ID: CVE-2014-4263 DESCRIPTION: Unspecified vulnerability in Oracle Java SE 5.0u65,...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Guardium Database Activity Monitoring (CVE-2014-3566)

Summary Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM Guardium Database Activity Monitoring, were disclosed as part of the IBM Java SDK updates in October 2014. The only fix applicable was for Padding Oracle On Downgraded Legacy...

Security Bulletin: IBM Security Guardium is affected by a OpenSource LibXML2 vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2015-8806 DESCRIPTION: Libxml2 is vulnerable to a denial of service, caused by a heap-buffer overread in dict.c. By persuading a victim to open a specially crafted file, a remote attacker cou...

Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2015-4160 DESCRIPTION: SAP ASE Database Platform is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add,...

Security Bulletin: IBM Security Guardium is affected by Using Components with Known Vulnerabilities vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2016-4950 DESCRIPTION: Cloudera Manager could allow a remote attacker to obtain sensitive information, caused by a flaw in the /api/v11/users/sessions module. By sending a specially-crafted...

Security Bulletin: IBM Security Guardium is affected by Using Components with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2012-3324 DESCRIPTION: IBM DB2, when running on Microsft Windows, could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of...

Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by an Application Error vulnerability

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1768 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG generates an error message that includes sensitive information about its environment,...

Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Session Identifier Not Updated vulnerability

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1375 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG does not renew a session variable after a successful authentication which could lead to...

Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Using Components with Known Vulnerabilities vulnerability

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2016-7103 DESCRIPTION: jQuery UI is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the dialog function. A remote...