Skip to content
OpenAdvisories
High WID-SEC-2026-2751 24 CVEs

IBM InfoSphere Guardium: Mehrere Schwachstellen

Published Dec 13, 2018 · Updated Aug 11, 2026 · Revision 2 · de-DE

Vendor: IBM Product: InfoSphere Guardium Product: InfoSphere Information Server Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Guardium ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.

Product

IBM InfoSphere Guardium ist eine Lösung zum Management und zur Überwachung von Datenbanksicherheit.

Vulnerabilities 24

  • High 8.8
    CVE-2015-5237

    protobuf susceptible to buffer overflow

    protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

    protobuf protobuf protobuf google/protobuf Debian Ubuntu Packagist Maven PyPI Go NuGet
  • High 8.8
    CVE-2016-6811

    Insecure Inherited Permissions in Apache Hadoop

    In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

    org.apache.hadoop:hadoop-common Maven
  • High 8.2
    CVE-2016-1182 EPSS 26%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE…

    struts:struts org.apache.struts:struts-core Maven
  • High 8.1
    CVE-2016-1181 EPSS 13%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a rela…

    struts:struts org.apache.struts:struts-core Maven
  • High 7.5
    CVE-2015-0899 EPSS 21%

    Improper Input Validation in Apache Struts

    The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

    struts:struts org.apache.struts:struts-core Maven
  • High 7.5
    CVE-2018-8012

    Missing Authorization in Apache ZooKeeper

    No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to t…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu Maven
  • High 7.3
    CVE-2017-3162

    Improper Input Validation in Apache Hadoop

    HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-client Maven
  • Medium 6.5
    CVE-2014-0229

    Improper Authentication in Apache Hadoop

    Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated…

    org.apache.hadoop:hadoop-common Maven
  • Medium 6.5
    CVE-2017-15713

    Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

    Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct…

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-main Maven
  • Medium 6.1
    CVE-2017-3161

    Improper Neutralization of Input During Web Page Generation in Apache Hadoop

    The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-client Maven
  • Medium 5.9
    CVE-2017-1597

    IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require t…

    IBM Security Guardium
  • Medium 5.6
    CVE-2018-3620

    Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…

    Intel Multiple linux-raspi2 linux-hwe Debian Ubuntu Alpine
  • Medium 5.6
    CVE-2018-3646

    Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…

    Intel Multiple linux-raspi2 linux-hwe Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2016-5001

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

    This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random…

    Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-common Maven
  • Medium 5.4
    CVE-2018-1889

    IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…

    IBM Security Guardium
  • Medium 5.4
    CVE-2018-1891

    IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…

    IBM Security Guardium
  • Low 3.7
    CVE-2017-1265

    IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates,…

    IBM Security Guardium
  • Low 3.7
    CVE-2017-1272

    IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclo…

    IBM Security Guardium
  • Low 3.7
    CVE-2018-1509

    IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might all…

    IBM Security Guardium
  • Unscored —
    CVE-2011-5320

    scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) vi…

    glibc Debian
  • Medium —
    CVE-2014-3627

    Improper Link Resolution Before File Access in Apache Hadoop

    The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive…

    org.apache.hadoop:hadoop-client Maven
  • Unscored —
    CVE-2017-15670

    The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow…

    glibc eglibc glibc Debian Ubuntu
  • Unscored —
    CVE-2017-15671

    The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could …

    glibc eglibc Debian Ubuntu
  • Unscored —
    CVE-2017-15804

    The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during une…

    glibc eglibc glibc Debian Ubuntu

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initial Release

References