Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
Product
IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.
Vulnerabilities 18
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
Medium 6.5
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking …
-
Medium 5.9
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorith…
-
Medium 5.9
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to…
-
Medium 5.9
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to…
-
Medium 5.9
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to…
-
Medium 5.3
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed tech…
-
Medium 5.3
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed tech…
-
Medium 5.3
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed tech…
-
Medium 5.3
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
-
Medium 4.4
IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. …
-
Medium 4.3
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Atta…
-
Medium 4.1
IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privil…
-
Low 2.6
File size limit bypass in node-fetch
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people…
-
Unscored —
Certificate verification error on Windows in crypto/x509
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
-
Unscored —
Data race and crash in net/http
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
-
Unscored —
Unbounded read from invalid inputs in encoding/binary
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Revision history
-
#5
Neue Updates von IBM aufgenommen
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
IBM Security Bulletin 7008449 vom 2023-06-29
https://www.ibm.com/support/pages/node/7008449
-
IBM Security Bulletin: 6403463 vom 2021-01-13
https://www.ibm.com/support/pages/node/6403463
-
Red Hat Security Advisory RHSA-2021:0521 vom 2021-02-15
https://access.redhat.com/errata/RHSA-2021:0521
-
Red Hat Security Advisory RHSA-2021:0548 vom 2021-02-16
https://access.redhat.com/errata/RHSA-2021:0548
-
Ubuntu Security Notice USN-4758-1 vom 2021-03-09
https://ubuntu.com/security/notices/USN-4758-1