Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by Information Exposure vulnerability (CVE-2017-1774 )

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability Vulnerability Details CVEID: CVE-2017-1774 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG discloses sensitive information to unauthorized users. The information can be used to mou...

Session fixation

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2018-1369

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767...

CVE-2017-1768

IBM Security Guardium Big Data Intelligence SonarG 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471...

Code injection

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

Design/Logic Flaw

IBM Security Guardium Big Data Intelligence SonarG 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471...

Information disclosure

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767...

Cross site scripting

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1375

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2018-1370

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1369

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1369

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 contains a vulnerability where sensitive information is stored in URL parameters, enabling potential information disclosure via server logs, referrer headers, or browser history. The issue affects SonarG 3.1 and is documented as CVE-2018-13...

CVE-2018-1375

CVE-2018-1375 affects IBM Security Guardium Big Data Intelligence (SonarG) 3.1. The issue is that a session variable is not renewed after successful authentication, which could enable session fixation/hijacking by forcing a user to use a cookie potentially known to an attacker (IBM X-Force ID: 13...

CVE-2018-1370

CVE-2018-1370 affects IBM Security Guardium Big Data Intelligence (SonarG) 3.1. The flaw is an incorrect permission assignment for a security-critical resource, allowing read/modify by unintended actors. The IBM bulletin lists a CVSS v3 base score of 4.2 and notes remediation is to upgrade to an ...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting in the Web UI, potentially allowing an attacker to embed arbitrary JavaScript and lead to credentials disclosure within a trusted session. The CVE is identified as CVE-2018-1376 with a CVSS v3 base scor...

CVE-2018-1375

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776...

CVE-2017-1768

CVE-2017-1768 affects IBM Security Guardium Big Data Intelligence (SonarG) version 3.1 . The issue is an application error that generates messages including sensitive information about the environment, users, or data, leading to partial confidentiality impact (CVSS 3.0/4.3). The IBM bulletin list...

CVE-2018-1376: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...