Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium. These issues were disclosed as part of the IBM Java SDK updates in October 2017. IBM Security Guardium has addressed the se vulnerabilities Vulnerability Details CVEID:...

Security Bulletin: IBM Security Guardium is affected by Using Components with Known vulnerabilities (multiple CVEs)

Summary IBM Security Guardium is affected by Using Components with Known vulnerabilities. IBM Security Guardium has fixed these vulnerabilities Vulnerability Details CVEID: CVE-2014-3584 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the processing of SAML tokens received...

Security Bulletin: OS Command Injection vulnerability affects IBM Security Guardium (CVE-2017-1253 )

Summary IBM Security Guardium could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1253 DESCRIPTION: IBM Security Guardium could allow a remote authenticated attacker to...

Security Bulletin: IBM Security Guardium is affected by XML External Entity vulnerability (CVE-2017-1254)

Summary IBM Security Guardium is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM Security Guardium has fixed this vulnerability Vulnerability...

Security Bulletin: SQL Injection vulnerability affects IBM Security Guardium (CVE-2017-1269)

Summary A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1269 DESCRIPTION: IBM Security Guardi...

Security Bulletin: Cross-Site Scripting vulnerability affects IBM Security Guardium (CVE-2017-1256)

Summary Cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID:...

Security Bulletin: Loading Code Without Integrity Check vulnerability affects IBM Security Guardium (CVE-2017-1267)

Summary IBM Security Guardium processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1267 DESCRIPTION: IBM Security Guardium processes patches,...

Security Bulletin: Improper Authentication vulnerability affects IBM Security Guardium (CVE-2017-1264)

Summary IBM Security Guardium does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality to unintended actors. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1264 DESCRIPTION: IBM...

Security Bulletin: Missing Authentication for Critical Function affects IBM Security Guardium (CVE-2017-1258)

Summary IBM Security Guardium does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1258 DESCRIPTION: IBM Security Guardium does...

Security Bulletin: multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect IBM Security Guardium Data Redaction. .

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium Data Redaction. IBM Security Guardium Data Redactionaddressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-3511 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by IBM Security Guardium Data Redaction. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2017-3272 DESCRIPTION: An unspecified vulnerabilit...

Security Bulletin: OpenSSL vulnerability affects IBM Security Guardium (CVE-2017-3731)

Summary OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read when using a specific cipher. Vulnerability Details CVEID: CVE-2017-3731 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read when using a specific cipher. By sending...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Database Activity Monitor

Summary Security Bulletin: There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 used by IBM Security Guardium Database Activity Monitor. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017 Vulnerability Details CVEID: CVE-2016-5546...

Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities (multiple CVEs)

Summary IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities. IBM Security Guardium addressed these issues Vulnerability Details CVEID: CVE-2016-0639 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Pluggable Authentication component...

Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerability (CVE-2017-3302)

Summary Multiple Oracle products are vulnerable to a denial of service, caused by a use-after-free vulnerability in the libmysqlclient.so. An attacker could exploit this vulnerability to cause the application to crash. IBM Security Guardium addressed this issue Vulnerability Details CVEID:...

Security Bulletin: Shell injection in CLI 'support execute' command affect IBM Security Guardium (CVE-2016-9974)

Summary IBM Security Guardium Database Activity Monitor could allow a locally authenticated attacker to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-9974 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a locally authenticated attacker to...

Security Bulletin: OpenSource GoPivotal Spring Framework Vulnerabilities affect IBM Security Guardium (CVE-2014-3578, CVE-2014-3625)

Summary Pivotal Spring Framework could allow a remote attacker to traverse directories on the system. IBM Security Guardium addressed these issues Vulnerability Details CVEID: CVE-2014-3578 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to traverse directories on the system. ...

Security Bulletin: OpenSource Spring Source/Pivotal Spring Framework Vulnerabilities affect IBM Security Guardium (CVE-2013-7315, CVE-2013-4152, CVE-2014-0054)

Summary Pivotal Spring Framework could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when...

Security Bulletin: Privilege escalation vulnerability affects IBM Security Guardium (CVE-2017-1122)

Summary IBM Security Guardium contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root. IBM Security Guardium has addressed this issue Vulnerability Details CVEID: CVE-2017-1122 DESCRIPTION: IBM Security Guardium...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction (CVE-2016-5597, CVE-2016-5542)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component could allow a remote attacker to obtain...