Cross site scripting

IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

Code injection

IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736...

CVE-2017-1257

IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 124684...

CVE-2017-1257

Summary: CVE-2017-1257 concerns an information disclosure in IBM Security Guardium. The vulnerability affects Guardium 10.x (notably 10.0, 10.0.x, 10.1, 10.1.x) where sensitive data can be disclosed to unauthorized users. The root cause is an information exposure weakness in Guardium that could e...

CVE-2017-1266

CVE-2017-1266 affects IBM Security Guardium, with an incorrect permission assignment for a security-critical resource that can allow read/modify by unintended actors. Affected versions: Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3. Reported CVSS v3 base score around 4.2 (vector: CVSS:3.0/AV:N/AC:H...

CVE-2017-1261

IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736...

CVE-2017-1596

IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132550...

CVE-2017-1598

IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 132611...

CVE-2017-1595

IBM Security Guardium Database Activity Monitor (Guardium) is affected by CVE-2017-1595, a local information disclosure vulnerability. The IBM Security Guardium Database Activity Monitor product family (V10.0, 10.0.1, 10.1, 10.1.2, 10.1.3) could allow a local attacker to obtain highly sensitive i...

CVE-2017-1262

IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as We...

CVE-2017-1266

IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 124741...

CVE-2017-1595

IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132549...

CVE-2017-1598

IBM Security Guardium Database Activity Monitor (V10.0–10.1.3) is affected by use of weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Root cause: cryptographic weakness in the product’s crypto implementation. Impact: potential confidentiality b...

CVE-2017-1600

IBM Security Guardium Database Activity Monitor is affected by CVE-2017-1600, a cross-site scripting vulnerability in the Web UI. The vulnerability allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products/versions include Gua...

CVE-2017-1757

IBM Security Guardium 10.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 135858...

CVE-2017-1757

CVE-2017-1757 affects IBM Security Guardium Database Activity Monitor (v10.0, and related 10.0.x–10.1.x ranges up to 10.1.3). The root cause is a SQL injection vulnerability that could allow a remote attacker to view, add, modify, or delete data in the back-end database. IBM’s bulletin lists reme...

CVE-2017-1261

CVE-2017-1261 affects IBM Security Guardium. The vulnerability arises from Guardium storing potentially sensitive information in log files, which a local attacker could read. Affected product versions include Guardium 10.0, 10.0.1, 10.1, 10.1.2, and 10.1.3. IBM provides a fix (Remediation/First F...

CVE-2017-1270

Summary: IBM Security Guardium 10.0 has a fixable session-management issue: it does not renew the session variable after authentication, enabling potential session fixation/hijacking. Affected versions: Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3. Root cause: failure to renew the session value po...

CVE-2017-1596

The CVE-2017-1596 entry affects IBM Security Guardium Database Activity Monitor (V10.0 to 10.1.3). It describes a local disclosure vulnerability in which a local attacker could obtain highly sensitive information via unspecified vectors. The IBM security bulletin confirms affected versions: 10.0,...

CVE-2017-1262

CVE-2017-1262 affects IBM Security Guardium, versions 10.0, 10.0.1, 10.1, 10.1.2, and 10.1.3, which are vulnerable to HTTP response splitting via specially crafted URLs. The underlying issue permits a remote attacker to trigger a split response, enabling follow-on attacks such as Web cache poison...