Security Bulletin: Shell injection in CLI 'support execute' command affect IBM Security Guardium (CVE-2016-9974)

Summary IBM Security Guardium Database Activity Monitor could allow a locally authenticated attacker to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2016-9974 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a locally authenticated attacker to...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by OS Command Injection (CVE-2016-6065)

Summary IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root. IBM Security Guardium Database Activity Monitor fixed this vulnerability Vulnerability Details CVEID: CVE-2016-6065 DESCRIPTION: IBM Security Guardium...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by the Open Source Oracle MySQL Vulnerabilities (CVE-2016-6664)

Summary Oracle MySQL could allow a local authenticated attacker to gain elevated privileges on the system, caused by the improper handling of the creation of error log file by the mysqldsafe script. An attacker could exploit this vulnerability to gain root privileges on the system. IBM Security...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source MySQL MySQL Vulnerabilities (CVE-2016-6663)

Summary MySQL could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition error while setting stats during MyISAM table repair. An attacker could exploit this vulnerability to change permissions of arbitrary files. IBM Security Guardium Databas...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3627)

Summary libxml2 is vulnerable to a denial of service, caused by an error in the xmlStringGetNodeList function when parsing xml files while in recover mode. An attacker could exploit this vulnerability to exhaust the stack and cause a segmentation fault. Vulnerability Details CVEID: CVE-2016-3627...

Security Bulletin: IBM Security Guardium is affected by Cross-Site Scripting vulnerability (CVE-2016-0246)

Summary IBM Security Guardium is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-4483)

Summary libxml2 is vulnerable to a denial of service, caused by an out-of-bounds read when parsing a specially crafted XML file if recover mode is used. By persuading a victim to open a specially crafted XML file, a remote attacker could exploit this vulnerability to cause the application to cras...

Security Bulletin:  IBM Security Guardium Database Activity Monitor is affected by Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2016-0240)

Summary IBM Security Guardium Database Activity Monitor does not force the HTTP Strict-Transport-Security Header. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0240 DESCRIPTION: IBM Security Guardium Database...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authorization Vulnerability (CVE-2016-0239)

Summary IBM Security Guardium Database Activity Monitor could allow a remote authenticated attacker to issue a specially HTTP request as administrator. Vulnerability Details CVEID: CVE-2016-0239 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a remote authenticated attack...

Security Bulletin: Path Traversal affects IBM Security Guardium Database Activity Monitor (CVE-2016-0298)

Summary IBM Security Guardium Database Activity Monitor could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-0298 DESCRIPTION: IBM Security Guardium...

Security Bulletin: Use of Hard-coded Cryptographic Key vulenrability affects IBM Security Guardium Database Activity Monitor (CVE-2016-0235)

Summary IBM Security Guardium Database Activity Monitor uses a hard-coded password for the which is available to the administrator or a user with root access. This password could be used across other GRUB systems. Vulnerability Details CVEID: CVE-2016-0235 DESCRIPTION: IBM Security Guardium...

Security Bulletin: Cacheable SSL Page vulnerability affects IBM Security Guardium Database Activity Monitor (CVE-2016-0237)

Summary IBM Security Guardium Database Activity Monitor contains locally cached browser data, that could allow a local attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-0237 DESCRIPTION: IBM Security Guardium Database Activity Monitor contains locally cached browser...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by OpenSource LibXML2 and LibXML Vulnerability (CVE-2015-7942 CVE-2015-8241 CVE-2015-8242)

Summary libxml2 is vulnerable to a stack-based buffer overflow, denial of service and a buffer overflow Vulnerability Details CVEID: CVE-2015-8242 DESCRIPTION: libxml2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the HTML parser in push mode in...

Security Bulletin: Multiple vulnerabilities in OpenSource Oracle Mysql affect IBM Security Guardium Database Activity Monitor

Summary Several unspecified vulnerability in Oracle MySQL Server could allow a remote attacker to cause a denial of service, obtain information, and have partial confidentiality, integrity, and availability impact. Vulnerability Details CVEID: CVE-2015-4815 DESCRIPTION: An unspecified vulnerabili...

Security Bulletin: InfoSphere Guardium Database Activity Monitoring vulnerable to multiple Oracle MySQL vulnerabilties

Summary InfoSphere Guardium Database Activity Monitoring vulnerable to the following Oracle MySQL vulnerabilties CVE-2014-6464, CVE-2014-6469, CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496, CVE-2014-6500, CVE-2014-6555, CVE-2014-6559 Vulnerability Details CVEID: CVE-2014-6464...

Security Bulletin: Open Source Apache Tomcat vulnerability (CVE-2014-0227)

Summary Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed chunked header to the Web server to cause multiple processing conflicts on the servers. An attacker could exploit this vulnerability to poison the web cache, bypa...

CVE-2017-1601

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

Default credentials

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

CVE-2017-1601

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

CVE-2017-1601

CVE-2017-1601 affects IBM Security Guardium Database Activity Monitor: vulnerable in versions 10.0, 10.0.1, and 10.1–10.1.4 where strong-password requirements are not enforced by default, enabling potential account compromise. The IBM bulletin enumerates the affected releases and provides remedia...