Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has fixed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-39077 DESCRIPTION: IBM Security Guardium stores user credentials in plain clear text which can be read by a local privileged user. CVSS Base score: 4.4 CVSS Temporal Score: See:...

CVE-2019-12423: Insufficiently Protected Credentials

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...

PT-2020-4103

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.2.12 Apache CXF versions prior to 3.3.5 Description: The issue is related to the OpenId Connect JWK Keys service in Apache CXF, which can return private key and secret key credentials if the user has configured...