PT-2020-11026

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2020-11034

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns active debugging code in the deployment of IBM Security Guardium Data Encryption, which can create unintended entry points. Recommendations For IBM Securi...

PT-2020-11024

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

PT-2020-11025

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle...

PT-2020-11029

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used by the software for inbound authentication, outbound communication to external...

CVE-2019-4694: Use of Hard-coded Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171832...

CVE-2019-4691: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium Data Encryption GDE 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2019-4686: Missing Encryption of Sensitive Data

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4695: Insecure Storage of Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926...

CVE-2019-4692: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 171829...

CVE-2019-4698: Weak Password Requirements

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929...

PT-2020-11027

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows sensitive information to be disclosed to unauthorized users. This information can then be used to mount further attacks on the system. Recommendations For I...

PT-2020-11040

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description A remote authenticated attacker could execute arbitrary commands on the system by sending a specially-crafted request, allowing the exploitation of the system. Recommendatio...

PT-2020-11033

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue concerns an error message generated by the software that includes sensitive information about its environment, users, or associated data. Recommendations For versi...

CVE-2019-4697: Insufficiently Protected Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938...

CVE-2019-4693: Insufficiently Protected Credentials

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 171831...

CVE-2019-4688: Reliance on Cookies without Validation and Integrity Checking

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4701: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936...

CVE-2019-4699: Generation of Error Message Containing Sensitive Information

IBM Security Guardium Data Encryption GDE 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931...

CVE-2019-4713: Undefined Security Weakness

IBM Security Guardium Data Encryption GDE 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084...