CVSS: 3.3EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1270
https://notcve.org/view.php?id=CVE-2017-1270
IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 124745. IBM Security Guardium 10.0 no renueva una variable de sesión tras una autenticación exitosa. Esto podría desembocar en una vulnerabilidad de fijación/secuestro de sesión. • http://www.ibm.com/support/docview.wss?uid=swg22010439 https://exchange.xforce.ibmcloud.com/vulnerabilities/124745 • CWE-384: Session Fixation •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1596
https://notcve.org/view.php?id=CVE-2017-1596
IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132550. IBM Security Guardium 10.0 Database Activity Monitor podría permitir que un atacante local obtenga información altamente sensible mediante vectores sin especificar. IBM X-Force ID: 132550. • http://www.ibm.com/support/docview.wss?uid=swg22009625 https://exchange.xforce.ibmcloud.com/vulnerabilities/132550 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1757
https://notcve.org/view.php?id=CVE-2017-1757
IBM Security Guardium 10.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 135858. IBM Security Guardium 10.0 es vulnerable a inyecciones SQL. Un atacante remoto podría enviar instrucciones SQL especialmente manipuladas que podrían permitir que el atacante viese, añadiese, modificase o borrase información en la base de datos del backend. • http://www.ibm.com/support/docview.wss?uid=swg22011554 http://www.securityfocus.com/bid/102300 https://exchange.xforce.ibmcloud.com/vulnerabilities/135858 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1267
https://notcve.org/view.php?id=CVE-2017-1267
IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 124742. IBM Security Guardium versión 10.0 y versión 10.1 procesa parches, copias de seguridad de imágenes y otras actualizaciones sin suficiente comprobación del origen y la integridad del código. ID de IBM X-Force: 124742. • http://www.ibm.com/support/docview.wss?uid=swg22004424 http://www.securityfocus.com/bid/99896 http://www.securitytracker.com/id/1038984 https://exchange.xforce.ibmcloud.com/vulnerabilities/124742 • CWE-20: Improper Input Validation •
CVSS: 9.9EPSS: 0%CPEs: 4EXPL: 0CVE-2017-1253
https://notcve.org/view.php?id=CVE-2017-1253
IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 124633. IBM Security Guardium 10.0 permite a un usuario remoto autenticado ejecutar comandos aleatorios en el sistema. Mediante el envió de solicitudes especialmente manipuladas, un atacante podría ejecutar comando aleatorios en el sistema. • http://www.ibm.com/support/docview.wss?uid=swg22004426 http://www.securityfocus.com/bid/99372 https://exchange.xforce.ibmcloud.com/vulnerabilities/124633 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •