CVE-2018-1369: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767...

CVE-2018-1376: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1375: Session Fixation

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2018-1370: Incorrect Permission Assignment for Critical Resource

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

PT-2018-12146

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue arises because the session variable is not renewed after a successful authentication, potentially leading to session fixation or hijacking. This could force a...

PT-2018-12157

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2018-12091

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue concerns the specification of permissions for a security-critical resource, allowing it to be read or modified by unintended actors. Recommendations For IBM...

PT-2018-12080

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the URLs...

PT-2018-6545

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description: The software generates an error message that includes sensitive information about its environment, users, or associated data. Recommendations: For IBM Security Guardi...

IBM Security Guardium Big Data Intelligence Information Disclosure Vulnerability (CNVD-2018-06604)

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. A security vulnerability exists in IBM Security Guardium Big Da...

CVE-2018-1373

IBM Security Guardium Big Data Intelligence SonarG 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773...

CVE-2018-1373

IBM Security Guardium Big Data Intelligence SonarG 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773...

CVE-2018-1373: Improper Restriction of Excessive Authentication Attempts

IBM Security Guardium Big Data Intelligence SonarG 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773...

PT-2018-12124

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations For IBM Security...

IBM Security Guardium Big Data Intelligence Information Disclosure Vulnerability

IBM Security Guardium Big Data Intelligence is a solution that delivers the capabilities of a big data platform while meeting data security requirements. An information disclosure vulnerability exists in IBM Security Guardium Big Data Intelligence SonarG 3.1. The vulnerability arises because the...

CVE-2018-1425

CVE-2018-1425 affects IBM Security Guardium Big Data Intelligence (SonarG) 3.1, which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM Security Guardium Big Data Intelligence (SonarG) product is listed as affected wit...

IBM Security Guardium Big Data Intelligence (SonarG) Information Disclosure Vulnerability

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. An information disclosure vulnerability exists in IBM Security...

CVE-2018-1372: Weak Password Requirements

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 137772...

CVE-2018-1425: Inadequate Encryption Strength

IBM Security Guardium Big Data Intelligence SonarG 3.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139003...

PT-2018-12361

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Big Data Intelligence SonarG version 3.1 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations...