CVE-2019-4693

IBM Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plaintext, allowing a locally authenticated privileged user to read them. This is documented across multiple sources (NVD entry CVE-2019-4693 and CNVD-2020-49941), confirming plaintext storage vulnerability in GDE 3.0.0.2. IBM’...

CVE-2019-4688

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4689

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2019-4691

IBM Security Guardium Data Encryption GDE 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2019-4688

CVE-2019-4688 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, which does not set the secure attribute on authorization tokens or session cookies. This omission could allow an attacker to obtain cookie values by luring a user to click an http:// link or via a malicious site, enabling cookie sn...

CVE-2019-4691

CVE-2019-4691 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2, with a cross-site scripting flaw that can embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session. Remediation: upgrade to GDE 4.0.0.3 (fixes noted in IBM bulletin). CVSSv3 base s...

CVE-2019-4689

Summary of CVE-2019-4689 (IBM Guardium Data Encryption, GDE) : GDE 3.0.0.2 stores HTTP Strict Transport Security incorrectly, allowing a remote attacker to obtain sensitive information via man-in-the-middle techniques. The vulnerability is caused by failure to properly enable HSTS, enabling poten...

CVE-2019-4686

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4686

CVE-2019-4686 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2. The root cause is failure to set the secure attribute on authorization tokens or session cookies, allowing an attacker to obtain cookie values by tricking a user into following an http link or via a link planted on a visit...

CVE-2018-1501

IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 141226...

CVE-2018-1501

CVE-2018-1501 affects IBM Security Guardium EcoSystem (versions 10.5, 10.6, 11.0). The root cause is missing security controls that could allow an unauthorized user to obtain sensitive information. IBM’s Security Bulletin notes remediation by upgrading to Guardium 11.2 (fix ID: SqlGuard_11.0p200_...

CVE-2019-4689: Cleartext Transmission of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

PT-2020-11030

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Security Guardium Data Encryption GDE version...

CVE-2018-1501: Missing Authentication for Critical Function

IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 141226...

PT-2020-11028

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns the storage of user credentials in plain text, which can be accessed by a local privileged user. Recommendations For IBM Security Guardium Data Encryption...

PT-2020-11031

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns the storage of user credentials in plain text, which can be accessed by an authenticated user. Recommendations For IBM Security Guardium Data Encryption G...

CVE-2019-4713: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084...

PT-2020-11032

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to compromise user accounts more easily due to a lack of strong password requirements by default. Recommendations For version 3.0.0.2, consider...

PT-2020-11023

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

PT-2020-11034

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns active debugging code in the deployment of IBM Security Guardium Data Encryption, which can create unintended entry points. Recommendations For IBM Securi...