89 matches found
CVE-2021-20474
IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 are affected by CVE-2021-20474, which describes an authentication bypass for functionality that requires a provable user identity or resource-intensive operations. The IBM Security Bulletin (B032181B9830877999C8B9122EBF4C2EA60F718942...
CVE-2021-20417
CVE-2021-20417 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is an information-disclosure flaw where a detailed technical error message returned in the browser could reveal sensitive data to a remote attacker. The IBM Security Bulletin notes this and states the vulnerability has b...
CVE-2021-20416
CVE-2021-20416 affects IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4, where the HTTPOnly flag is not set on cookies, enabling a remote attacker to access sensitive cookie information. The IBM security bulletin notes fixes in GDE 4.0.0.5 and newer; upgrading to that version (or newer) is ...
CVE-2021-20415
IBM Guardium Data Encryption (GDE) 4.0.0.4 is affected by an inadequate account lockout setting that could let a remote attacker brute-force credentials. The issue is documented under CVE-2021-20415 and is addressed by IBM in a security bulletin that notes fixes in GDE 4.0.0.5 (and newer 5.x seri...
CVE-2021-20415
IBM Guardium Data Encryption GDE 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217...
CVE-2021-20379
Summary: CVE-2021-20379 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.3 and 4.0.0.4, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Details in sources: the NVD entry states the cryptographic weakness and impact; IBM...
CVE-2021-20378
CVE-2021-20378 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 . The vulnerability is that GDE does not invalidate sessions after logout, enabling an authenticated user to impersonate another user on the system. Connected sources corroborate the issue in IBM Guardium/GDE a...
CVE-2021-20413
CVE-2021-20413 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is a processing/logical error that could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a browser. Remediation is available: GDE fixed in 4.0.0.5. No exploi...
CVE-2021-20413
IBM Guardium Data Encryption GDE 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196212...
Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) (CVE-2017-18214, CVE-2016-4055, CVE-2021-20413)
Summary There are multiple vulnerabilities identified in IBM Guardium Data Encryption GDE. These vulnerabilities have been fixed in GDE 4.0.0.5. Please apply the latest version to obtain the fixes. Vulnerability Details CVEID: CVE-2017-18214 DESCRIPTION: Node.js moment module is vulnerable to a...
Information disclosure
IBM Security Guardium Data Encryption GDE 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 171823...
CVE-2019-4702
CVE-2019-4702 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where permissions on a security-critical resource allow read/modify by unintended actors. The issue is described as improper privilege control in GDE 3.0.0.2. Connected sources also indicate remediation: the vulnerability is fixed ...
CVE-2019-4687
CVE-2019-4687 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2, where sensitive data is stored in URL parameters. The root cause is the disclosure risk from information in URLs that can be exposed via server logs, referrer headers, or browser history. The vulnerability is documented ac...
CVE-2019-4702
IBM Security Guardium Data Encryption GDE 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors...
CVE-2019-4160
CVE-2019-4160 affects IBM Guardium Data Encryption (GDE) version 3.0.0.2, which uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The issue is specific to GDE 3.0.0.2; IBM’s bulletin notes that fixes are available in GDE 4.0.0...
Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)
Summary There are multiple vulnerabilities identified in IBM Guardium Data Encryption GDE. These vulnerabilities have been fixed in GDE 4.0.0.4. Please apply the latest version for the fixes. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is vulnerable to a denial of service,...
cas.gde.gob.ar Cross Site Scripting vulnerability OBB-1489926
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2019-4695
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is affected by an information-disclosure vulnerability where web pages stored locally could be read by another local user. The issue is described in CVE-2019-4695 and is addressed by upgrading to GDE 4.0.0.0, per IBM’s bulletin. Connected source...
CVE-2019-4691
IBM Security Guardium Data Encryption GDE 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...
CVE-2019-4698
IBM Security Guardium Data Encryption GDE 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929...