Authentication flaw

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources...

CVE-2021-20474

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources...

CVE-2021-20474

IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 are affected by CVE-2021-20474, which describes an authentication bypass for functionality that requires a provable user identity or resource-intensive operations. The IBM Security Bulletin (B032181B9830877999C8B9122EBF4C2EA60F718942...

CVE-2021-20417

CVE-2021-20417 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is an information-disclosure flaw where a detailed technical error message returned in the browser could reveal sensitive data to a remote attacker. The IBM Security Bulletin notes this and states the vulnerability has b...

CVE-2021-20417

IBM Guardium Data Encryption GDE 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219...

CVE-2021-20416

CVE-2021-20416 affects IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4, where the HTTPOnly flag is not set on cookies, enabling a remote attacker to access sensitive cookie information. The IBM security bulletin notes fixes in GDE 4.0.0.5 and newer; upgrading to that version (or newer) is ...

CVE-2021-20415

IBM Guardium Data Encryption (GDE) 4.0.0.4 is affected by an inadequate account lockout setting that could let a remote attacker brute-force credentials. The issue is documented under CVE-2021-20415 and is addressed by IBM in a security bulletin that notes fixes in GDE 4.0.0.5 (and newer 5.x seri...

CVE-2021-20415

IBM Guardium Data Encryption GDE 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217...

CVE-2021-20379

Summary: CVE-2021-20379 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.3 and 4.0.0.4, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Details in sources: the NVD entry states the cryptographic weakness and impact; IBM...

CVE-2021-20378

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

CVE-2021-20378

CVE-2021-20378 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 . The vulnerability is that GDE does not invalidate sessions after logout, enabling an authenticated user to impersonate another user on the system. Connected sources corroborate the issue in IBM Guardium/GDE a...

CVE-2021-20416: Incorrect Permission Assignment for Critical Resource

IBM Guardium Data Encryption GDE 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218...

CVE-2021-20417: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Encryption GDE 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219...

CVE-2021-20474: Missing Authentication for Critical Function

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources...

CVE-2021-20379: Use of a Broken or Risky Cryptographic Algorithm

IBM Guardium Data Encryption GDE 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195711...

CVE-2021-20415: Improper Restriction of Excessive Authentication Attempts

IBM Guardium Data Encryption GDE 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217...

CVE-2021-20378: Insufficient Session Expiration

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

IBM Guardium Data Encryption 信息泄露漏洞

IBM Security Guardium Data Encryption is an American IBM software for securing sensitive data within an organization. The software protects assets located in cloud, virtual, big data and physical environments by controlling access to databases, files, applications and containers. An information...

CVE-2021-20416

IBM Guardium Data Encryption GDE 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218...

IBM Guardium Data Encryption 安全漏洞

IBM Guardium Data Encryption GDE is a software application from IBM, USA. It provides a data security and compliance solution. A security vulnerability exists in IBM Guardium Data Encryption GDE 4.0.0.4, which arises from a vulnerability that allows a remote attacker to brute-force break account...