PT-2020-11025

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle...

PT-2020-11032

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to compromise user accounts more easily due to a lack of strong password requirements by default. Recommendations For version 3.0.0.2, consider...

PT-2020-8536

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 10.5 through 11.0 Description: The issue is related to missing security controls, which could allow an unauthorized user to obtain sensitive information. Recommendations: For IBM Security Guardium versions 10.5...

PT-2020-11029

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used by the software for inbound authentication, outbound communication to external...

CVE-2019-4694: Use of Hard-coded Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171832...

CVE-2019-4691: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium Data Encryption GDE 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2019-4686: Missing Encryption of Sensitive Data

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4695: Insecure Storage of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926...

CVE-2019-4698: Weak Password Requirements

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929...

CVE-2019-4692: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 171829...

PT-2020-11027

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows sensitive information to be disclosed to unauthorized users. This information can then be used to mount further attacks on the system. Recommendations For I...

PT-2020-11040

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description A remote authenticated attacker could execute arbitrary commands on the system by sending a specially-crafted request, allowing the exploitation of the system. Recommendatio...

CVE-2018-1501: Missing Authentication for Critical Function

IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 141226...

CVE-2019-4697: Insufficiently Protected Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938...

CVE-2019-4693: Insufficiently Protected Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 171831...

CVE-2019-4688: Reliance on Cookies without Validation and Integrity Checking

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4701: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936...

CVE-2019-4699: Generation of Error Message Containing Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931...

PT-2020-11026

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

IBM Security Guardium Insights Open Redirection Vulnerability

IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. IBM Security Guardium Insights 2.0.1 suffers from an open redirection vulnerability. An attacker could exploit this vulnerabilit...