CVE-2021-39026

CVE-2021-39026 affects IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3, due to a failure to properly enable HTTP Strict Transport Security. This information disclosure vulnerability could let a remote attacker obtain sensitive data via man-in-the-middle techniques. IBM’s bulletin confirms ...

CVE-2021-39022

CVE-2021-39022 affects IBM Guardium Data Encryption (GDE) versions 4.0.0.0 and 5.0.0.0. The vulnerability arises because GDE saves user-provided information in a CSV file without proper escaping, enabling special elements to be interpreted as commands when the file is opened by spreadsheet softwa...

CVE-2021-39025

CVE-2021-39025 affects IBM Guardium Data Encryption (GDE) components when the web backend is down, allowing disclosure of internal IP address information. Affected products/versions include GDE: DSM 4.0.0.0 to 4.0.0.7 (and 4.0.0.7 specifically), GCKM 1.10.1 and lower, and CT-VL 2.6.3 and lower; o...

CVE-2021-39020

IBM Guardium Data Encryption (GDE) has an information disclosure vulnerability (CVE-2021-39020) where sensitive data is stored in URL parameters. Affected: Vormetric Data Security Manager (DSM) inside GDE Server 4.0.0.7 and earlier. Impact described as potential exposure via server logs, referrer...

CVE-2021-39023

IBM Guardium Data Encryption (GDE) is affected by CVE-2021-39023 via information disclosure when a detailed browser error message is returned. Affects Guardium Cloud Key Manager (GCKM) 1.10.1 (fixed in 1.10.2), CipherTrust Tokenization Server (CT-VL) 2.6.4.21 (fixed in 2.6.5.98), and Manager (CM)...

CVE-2021-39024

IBM Guardium Data Encryption (GDE) versions 4.0.0.0 and 5.0.0.0 are vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript in trusted sessions and potential credential disclosure. The IBM Security Bulletin summarizes the issue and references CVE-2021-39024, with CVSS v3....

CVE-2021-39027

CVE-2021-39027 affects IBM Guardium Data Encryption (GDE) versions 4.0.0 and 5.0.0. The vulnerability arises from missing or incorrect encoding/escaping in a structured message sent to another component, resulting in the intended message structure not being preserved. Impact is described as data ...

CVE-2021-39021

IBM Guardium Data Encryption (GDE) 5.0.0.2 (Guardium Data Encryption Server 5.0.0.2 / CipherTrust Manager 2.4.2) exhibits behavior where responses differ under certain conditions in a way observable to an unauthenticated actor, enabling username enumeration. The issue is confirmed in multiple sou...

CVE-2019-4694

CVE-2019-4694 involves IBM Guardium Data Encryption (GDE) 3.0.0.2, which contains hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. The underlying risk is credential exposure within the product, as described in the CVE record and corrobor...

CVE-2021-20413

CVE-2021-20413 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is a processing/logical error that could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a browser. Remediation is available: GDE fixed in 4.0.0.5. No exploi...

CVE-2019-4689

Summary of CVE-2019-4689 (IBM Guardium Data Encryption, GDE) : GDE 3.0.0.2 stores HTTP Strict Transport Security incorrectly, allowing a remote attacker to obtain sensitive information via man-in-the-middle techniques. The vulnerability is caused by failure to properly enable HSTS, enabling poten...

CVE-2019-4713

CVE-2019-4713 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2. A remote authenticated attacker could send a specially crafted request to execute arbitrary commands on the system. Public sources confirm the flaw and its impact (high CWE/CVSS), with IBM providing a fixed version in GDE ...

CVE-2019-4701

CVE-2019-4701 concerns IBM Guardium Data Encryption (GDE) 3.0.0.2, where active debugging code can create unintended entry points. Connected sources (CNVD-2020-50543) describe a cross-site scripting vulnerability in GDE 3.0.0.2 related to this issue, attributed to an unintended debugger entry. Th...

CVE-2021-20378

CVE-2021-20378 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 . The vulnerability is that GDE does not invalidate sessions after logout, enabling an authenticated user to impersonate another user on the system. Connected sources corroborate the issue in IBM Guardium/GDE a...

CVE-2021-20414

CVE-2021-20414 affects IBM Guardium Data Encryption (GDE) 3.0.0.2. The vulnerability allows a user to brute-force sensitive information due to not properly limiting the number of interactions. IBM’s security bulletin fixes this by upgrading to GDE 5.0.0.x (fixes are listed in the bulletin). No ex...

CVE-2019-4686

CVE-2019-4686 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2. The root cause is failure to set the secure attribute on authorization tokens or session cookies, allowing an attacker to obtain cookie values by tricking a user into following an http link or via a link planted on a visit...

CVE-2019-4699

CVE-2019-4699 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where an error message can reveal sensitive information about the environment, users, or data. The root cause is information disclosure via error details generated by GDE. Practical impact is information exposure with a low base sc...

CVE-2021-20379

Summary: CVE-2021-20379 affects IBM Guardium Data Encryption (GDE) versions 3.0.0.3 and 4.0.0.4, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Details in sources: the NVD entry states the cryptographic weakness and impact; IBM...

CVE-2019-4697

Summary (grounded): CVE-2019-4697 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where user credentials are stored in plaintext and readable by an authenticated user. The vulnerability stems from plaintext storage in GDE 3.0.0.2, enabling credential disclosure. The IBM/IBM X-Force and CNVD/N...

CVE-2019-4688

CVE-2019-4688 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, which does not set the secure attribute on authorization tokens or session cookies. This omission could allow an attacker to obtain cookie values by luring a user to click an http:// link or via a malicious site, enabling cookie sn...

CVE-2019-4692

CVE-2019-4692 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, where sensitive information is disclosed to unauthorized users. The vulnerability is an information disclosure flaw that could enable attackers to obtain data and potentially mount further attacks. Affected product: GDE 3.0.0.2. Un...

CVE-2021-20474

IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 are affected by CVE-2021-20474, which describes an authentication bypass for functionality that requires a provable user identity or resource-intensive operations. The IBM Security Bulletin (B032181B9830877999C8B9122EBF4C2EA60F718942...

CVE-2019-4695

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is affected by an information-disclosure vulnerability where web pages stored locally could be read by another local user. The issue is described in CVE-2019-4695 and is addressed by upgrading to GDE 4.0.0.0, per IBM’s bulletin. Connected source...

CVE-2019-4691

CVE-2019-4691 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2, with a cross-site scripting flaw that can embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session. Remediation: upgrade to GDE 4.0.0.3 (fixes noted in IBM bulletin). CVSSv3 base s...

CVE-2021-20415

IBM Guardium Data Encryption (GDE) 4.0.0.4 is affected by an inadequate account lockout setting that could let a remote attacker brute-force credentials. The issue is documented under CVE-2021-20415 and is addressed by IBM in a security bulletin that notes fixes in GDE 4.0.0.5 (and newer 5.x seri...

CVE-2019-4698

IBM Guardium Data Encryption (GDE) 3.0.0.2 is affected by a password-strength requirement weakness: by default, it does not require strong passwords, which could allow an attacker to compromise user accounts. The issue is documented in CVE-2019-4698 and reflected in IBM/third-party sources in the...

CVE-2021-20417

CVE-2021-20417 affects IBM Guardium Data Encryption (GDE) 4.0.0.4. The issue is an information-disclosure flaw where a detailed technical error message returned in the browser could reveal sensitive data to a remote attacker. The IBM Security Bulletin notes this and states the vulnerability has b...

CVE-2019-4693

IBM Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plaintext, allowing a locally authenticated privileged user to read them. This is documented across multiple sources (NVD entry CVE-2019-4693 and CNVD-2020-49941), confirming plaintext storage vulnerability in GDE 3.0.0.2. IBM’...

CVE-2021-20416

CVE-2021-20416 affects IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4, where the HTTPOnly flag is not set on cookies, enabling a remote attacker to access sensitive cookie information. The IBM security bulletin notes fixes in GDE 4.0.0.5 and newer; upgrading to that version (or newer) is ...