Input validation

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

Design/Logic Flaw

IBM Security Guardium Big Data Intelligence SonarG 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 161037...

Design/Logic Flaw

IBM Security Guardium Big Data Intelligence SonarG 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141...

CVE-2019-4600

CVE-2019-4600 is an information-disclosure vulnerability in IBM API Connect, affecting versions 5.0.0.0 through 5.0.8.7. A specially crafted HTTP request could reveal sensitive information. According to IBM’s security bulletin, the issue impacts the Developer Portal in API Connect and is addresse...

CVE-2019-4339

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 161418...

CVE-2019-4339

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 is affected by CVE-2019-4339 due to use of weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The vendor bulletin lists 4.0 as affected and provides a remediation: upgrade to the 4.1.0 inst...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

CVE-2019-4330

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 is affected by CVE-2019-4330: cookies in HTTPS sessions may lack the Secure attribute, potentially allowing cookies to be sent in plaintext over HTTP. Affected product/version: SonarG 4.0. Root cause: missing secure attribute on cookies. Im...

CVE-2019-4329

CVE-2019-4329 affects IBM Security Guardium Big Data Intelligence (SonarG) 4.0. The issue arises from incomplete blacklisting in input validation, enabling bypass of application controls and potential impact to system integrity. Public sources (IBM advisory) confirm affected version 4.0 and provi...

CVE-2019-4314

IBM Security Guardium Big Data Intelligence SonarG 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141...

CVE-2019-4311

CVE-2019-4311 affects IBM Security Guardium Big Data Intelligence (SonarG) 4.0. The vulnerability is an information-disclosure flaw that allows unauthorized users to access sensitive information, potentially enabling further attacks. The vulnerability is documented with CVSS v3.1 base score 5.3 (...

CVE-2019-4309

CVE-2019-4309 affects IBM Security Guardium Big Data Intelligence (SonarG) v4.0 and is caused by hard-coded credentials, enabling a local user to obtain highly sensitive information. The vulnerability is documented in IBM advisories and CVSS scores range from 5.5 (3.1) / 5.9 (3.0)MEDIUM, with loc...

CVE-2019-4307

IBM Security Guardium Big Data Intelligence SonarG 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987...

CVE-2019-4309

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM X-Force ID: 161035...

CVE-2019-4306

IBM Security Guardium Big Data Intelligence SonarG 4.0 specifies permissions for a security-critical resource which could lead to the exposure of sensitive information or the modification of that resource by unintended parties. IBM X-Force ID: 160986...

CVE-2019-4306

CVE-2019-4306 affects IBM Security Guardium Big Data Intelligence (SonarG) 4.0. The vulnerability arises from permissions configured on a security-critical resource, enabling exposure of sensitive information and potential modification by unintended parties (impacting confidentiality and integrit...

CVE-2019-4036

IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159...

CVE-2019-4394

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232...

Code injection

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232...

Code injection

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 162260...