Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by OpenSource LibXML2 and LibXML Vulnerability (CVE-2015-7942 CVE-2015-8241 CVE-2015-8242)

Summary libxml2 is vulnerable to a stack-based buffer overflow, denial of service and a buffer overflow Vulnerability Details CVEID: CVE-2015-8242 DESCRIPTION: libxml2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the HTML parser in push mode in...

Information disclosure

IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. IBM X-Force ID: 110328...

CVE-2016-0237: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. IBM X-Force ID: 110328...

CVE-2016-0235: Use of Hard-coded Credentials

IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems. IBM X-Force ID: 110326...

PT-2018-4591

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor version 10 Description The issue allows local users to obtain sensitive information by reading cached browser data. Recommendations For IBM Security Guardium Database Activity Monitor version 10,...

PT-2018-4590

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor version 10 Description The issue allows local users to have an unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems. Recommendations For I...

CVE-2018-1368: Improper Privilege Management

IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM...

PT-2018-12069

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor versions 9.0 through 9.5 Description The issue allows a local user with low privileges to view report pages and perform certain actions that are restricted to administrators, posing a risk of...

CVE-2016-6065: Improper Neutralization of Special Elements used in an OS Command

IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root...

PT-2017-8877

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor appliance affected versions not specified Description A local user could inject commands that would be executed as root, potentially allowing for elevated privileges and unauthorized system...

CVE-2016-0240

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...

CVE-2016-0240: Undefined Security Weakness

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...

PT-2016-4150

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor versions 8.2 before p310 IBM Security Guardium Database Activity Monitor versions 9.x through 9.5 before p700 IBM Security Guardium Database Activity Monitor versions 10.x through 10.1 before p10...

CVE-2016-0241: Improper Access Control

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP...

CVE-2016-0328: Improper Neutralization of Special Elements used in a Command

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain administrator privileges for command execution via unspecified vectors...

CVE-2016-0239: Undefined Security Weakness

IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with administrator privileges via unspecified vectors...

PT-2016-4107

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor versions 8.2 before p310 IBM Security Guardium Database Activity Monitor versions 9.x through 9.5 before p700 IBM Security Guardium Database Activity Monitor versions 10.x through 10.1 before p10...

PT-2016-4106

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor versions 9.x through 9.5 before p700 IBM Security Guardium Database Activity Monitor versions 10.x through 10.0.1 before p100 Description The issue allows remote authenticated users to make HTTP...

PT-2016-4108

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor versions 8.2 before p310 IBM Security Guardium Database Activity Monitor versions 9.x through 9.5 before p700 IBM Security Guardium Database Activity Monitor versions 10.x through 10.1 before p10...

CVE-2016-0236: Improper Neutralization of Special Elements used in a Command

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to execute arbitrary commands with root privileges via the search field...