Security Bulletin: IBM Security Guardium is affected by Cross-Site Scripting vulnerability (CVE-2016-0246)

Summary IBM Security Guardium is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web...

Security Bulletin: IBM Security Guardium is affected by Password in Clear Text vulnerability (CVE-2016-0247)

Summary IBM Security Guardium could allow a local user to obtain sensitive information including password information that would be transmitted in clear text. Vulnerability Details CVEID: CVE-2016-0247 DESCRIPTION: IBM Security Guardium could allow a local user to obtain sensitive information...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by SQL Injection vulnerability (CVE-2016-0249)

Summary IBM Security Guardium Database Activity Monitor is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database Vulnerability Details CVEID: CVE-2016-0249...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-4483)

Summary libxml2 is vulnerable to a denial of service, caused by an out-of-bounds read when parsing a specially crafted XML file if recover mode is used. By persuading a victim to open a specially crafted XML file, a remote attacker could exploit this vulnerability to cause the application to cras...

Security Bulletin: IBM Security Guardium is affected by Application Error vulnerability (CVE-2016-0242)

Summary IBM Security Guardium could disclose sensitive information about its environment, users, or associated data in the error message when an authenticated user produces errors. Vulnerability Details CVEID: CVE-2016-0242 DESCRIPTION: IBM Security Guardium could disclose sensitive information...

Security Bulletin: IBM Security Guardium is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3705)

Summary libxml2 is vulnerable to a stack-based buffer overflow, caused by an out-of-bounds read of xmlParserEntityCheck and xmlParseAttValueComplex functions in parser.c. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary...

Security Bulletin:  IBM Security Guardium Database Activity Monitor is affected by Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2016-0240)

Summary IBM Security Guardium Database Activity Monitor does not force the HTTP Strict-Transport-Security Header. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0240 DESCRIPTION: IBM Security Guardium Database...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authentication Vulnerability (CVE-2016-0241)

Summary IBM Security Guardium Database Activity Monitor could allow a local attacker to bypass security authorization and masquerade as the administrator by manipulating the HTTP login request. Vulnerability Details CVEID: CVE-2016-0241 DESCRIPTION: IBM Security Guardium Database Activity Monitor...

Security Bulletin: IBM InfoSphere Guardium is affected by Cleartext Transmission of Sensitive Information vulnerability (CVE-2016-0238 )

Summary IBM Security Guardium transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0238 DESCRIPTION: IBM Security Guardium transmits sensitive data ...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authorization Vulnerability (CVE-2016-0239)

Summary IBM Security Guardium Database Activity Monitor could allow a remote authenticated attacker to issue a specially HTTP request as administrator. Vulnerability Details CVEID: CVE-2016-0239 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a remote authenticated attack...

Security Bulletin: IBM Security Guardium is affected by OpenSource GNU glibc Vulnerability (CVE-2015-8776 CVE-2015-5229)

Summary GNU C Library glibc is vulnerable to a denial of service. IBM Security Guardium has provided a fix for this issue Vulnerability Details CVEID: CVE-2015-8776 DESCRIPTION: GNU C Library glibc is vulnerable to a denial of service. By passing out-of-range time values to the strftime function,...

Security Bulletin: IBM Security Guardium is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-4447 CVE-2016-4448 CVE-2016-4449)

Summary Open Source XMLsoft Libxml2 Vulnerabilities affects IBM Security Guardium. IBM Security Guardium has fixed these vulnerabilites Vulnerability Details CVEID: CVE-2016-4447 DESCRIPTION: libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow. By persuading a...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Guardium

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Security Guardium. IBM Security Guardium has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by...

Security Bulletin: : Vulnerabilities in OpenSSL affect IBM Security Guardium (CVE-2015-3197)

Summary OpenSSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. OpenSSL is used by IBM Security Guardium. IBM Security Guardium has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct...

Security Bulletin: OpenSource Oracle MySQL Vulnerability affects IBM Security Guardium (CVE-2016-2047)

Summary Oracle MySQL, MariaDB and Percona Server could allow a remote attacker to bypass security restrictions. IBM Security Guardium has addressed the applicable CVE Vulnerability Details CVEID: CVE-2016-2047 DESCRIPTION: Oracle MySQL, MariaDB and Percona Server could allow a remote attacker to...

Security Bulletin: : Multiple Vulnerabilities in OpenSSL affect IBM Security Guardium

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Security Guardium . IBM Security Guardium has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitra...

Security Bulletin: Vulnerabilities in OpenSource libxml2 affect IBM Security Guardium (CVE-2016-2073)

Summary libxml2 is vulnerable to a heap-based buffer overflow. IBM Security Guardium has addressed the applicable CVE Vulnerability Details CVEID: CVE-2016-2073 DESCRIPTION: libxml2 is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the htmlParseNameComplex function...

Security Bulletin: InstallShield and InstallAnywhere vulnerabilities affect IBM Security Guardium Data Redaction (CVE-2016-2542)

Summary Flexera InstallShield could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search path. An attacker could exploit this vulnerability using a Trojan horse DLL in the current working directory of a setup-launcher executable file to gain elevated...

Security Bulletin: Query Parameter in SSL Request vulnerability affects IBM Security Guardium (CVE-2016-0248)

Summary IBM Security Guardium transmits query parameters in SSL requests, that could be intercepted by a remote attacker using man in the middle techniques Vulnerability Details CVEID: CVE-2016-0248 DESCRIPTION: IBM Security Guardium transmits query parameters in SSL requests, that could be...

Security Bulletin: Path Traversal affects IBM Security Guardium Database Activity Monitor (CVE-2016-0298)

Summary IBM Security Guardium Database Activity Monitor could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-0298 DESCRIPTION: IBM Security Guardium...