Security Bulletin: vulnerabilities in OpenSource Oracle MySQL Server affect IBM Security Guardium

Summary An unspecified vulnerability in Oracle MySQL Server related to the Server could allow a remote attacker to cause a denial of service Vulnerability Details CVEID: CVE-2015-2582 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server : GIS component could allo...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, that is used by IBM Security Guardium. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability and Java SE...

Security Bulletin: Vulnerabilities in Open Source libuser affect IBM Security Guardium (CVE-2015-3246, CVE-2015-3245)

Summary The vulnerabilities allow local users to perform denial-of-service and privilege-escalation attacks Vulnerability Details CVEID: CVE-2015-3246 DESCRIPTION: libuser could allow a local authenticated attacker to gain elevated privileges on the system, caused by the improper handling of the...

IBM Security Guardium Big Data Intelligence Information Disclosure Vulnerability (CNVD-2018-16540)

IBM Security Guardium is the comprehensive data security platform. An information disclosure vulnerability exists in IBM Security Guardium Big Data Intelligence SonarG version 3.1. It allows an attacker to gain access to data related to the environment, users, and more...

IBM Security Guardium Big Data Intelligence Cross-Site Scripting Vulnerability

IBM Security Guardium Big Data Intelligence is a solution that delivers the capabilities of a big data platform while meeting data security requirements. A cross-site scripting vulnerability exists in IBM Security Guardium Big Data Intelligence SonarG. The vulnerability can be exploited by a user...

CVE-2017-1768

IBM Security Guardium Big Data Intelligence SonarG 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471...

Session fixation

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

Design/Logic Flaw

IBM Security Guardium Big Data Intelligence SonarG 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471...

Code injection

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

CVE-2018-1375

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1369

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1375

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2017-1768

IBM Security Guardium Big Data Intelligence SonarG 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471...

CVE-2017-1768

CVE-2017-1768 affects IBM Security Guardium Big Data Intelligence (SonarG) version 3.1 . The issue is an application error that generates messages including sensitive information about the environment, users, or data, leading to partial confidentiality impact (CVSS 3.0/4.3). The IBM bulletin list...

CVE-2018-1370

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

Code injection

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 124675...

Default credentials

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

CVE-2017-1255

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 124675...