Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities (Apache Struts) vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An...

Security Bulletin: IBM Security Guardium is affected by a Cross-Site scripting vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-1891 DESCRIPTION: IBM Security Guardium is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...

Security Bulletin: IBM Security Guardium is affected by a Query Parameter in SSL Request vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1272 DESCRIPTION: IBM Security Guardium stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server...

CVE-2018-1818

IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022...

CVE-2018-1817

IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021...

CVE-2018-1817

IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021...

CVE-2018-1818

IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022...

CVE-2017-1268

IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 124743...

Hardcoded credentials

IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022...

Cross site scripting

IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021...

Design/Logic Flaw

IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 124743...

CVE-2017-1268

IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 124743...

CVE-2018-1817

IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021...

CVE-2018-1818

IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022...

CVE-2018-1817

IBM Security Guardium 10.0–10.5 is vulnerable to cross-site scripting in the Web UI, allowing an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The root cause is a Web UI input handling issue (CVE-2018-1817). A remediation is available: upgr...

CVE-2018-1818

CVE-2018-1818 affects IBM Security Guardium 10.0–10.5, which contains hard-coded credentials used for internal encryption/authentication and outbound communications. Root cause: hard-coded credentials exist within the Guardium components. Impact: potential unauthorized access or trusted communica...

CVE-2017-1268

IBM Security Guardium versions 10.0–10.5 are affected by CVE-2017-1268 due to using a single cryptographic hash without salt, enabling potential information disclosure. The IBM security bulletin lists remediation by upgrading to a fixed release (10.6, e.g., SqlGuard_10.0p600_GPU_Nov-2018-V10.6). ...

CVE-2017-1268

IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 124743...

Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in MessageLite::SerializeToString. A remo...

PT-2018-14350

Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 10 through 10.5 Description The issue concerns hard-coded credentials, including passwords or cryptographic keys, used by IBM Security Guardium for inbound authentication, communication with external components, ...