CVE-2019-4687: Cleartext Storage of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 171823...

CVE-2019-4160: Inadequate Encryption Strength

IBM Security Guardium Data Encryption GDE 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158577...

CVE-2019-4713: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084...

PT-2020-11031

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns the storage of user credentials in plain text, which can be accessed by an authenticated user. Recommendations For IBM Security Guardium Data Encryption G...

CVE-2019-4701: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936...

PT-2020-11030

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Security Guardium Data Encryption GDE version...

PT-2020-11027

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows sensitive information to be disclosed to unauthorized users. This information can then be used to mount further attacks on the system. Recommendations For I...

PT-2020-11029

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used by the software for inbound authentication, outbound communication to external...

PT-2020-11040

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description A remote authenticated attacker could execute arbitrary commands on the system by sending a specially-crafted request, allowing the exploitation of the system. Recommendatio...

CVE-2019-4686: Missing Encryption of Sensitive Data

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4695: Insecure Storage of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926...

PT-2020-11033

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns an error message generated by the software that includes sensitive information about its environment, users, or associated data. Recommendations For versi...

PT-2020-11032

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to compromise user accounts more easily due to a lack of strong password requirements by default. Recommendations For version 3.0.0.2, consider...

PT-2020-11026

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

CVE-2019-4692: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 171829...

CVE-2019-4689: Cleartext Transmission of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2019-4699: Generation of Error Message Containing Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931...

CVE-2019-4693: Insufficiently Protected Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 171831...

PT-2020-11024

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

CVE-2019-4688: Reliance on Cookies without Validation and Integrity Checking

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...