DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM Security Guardium: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2021-01-13
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
01
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-4604US | medium4.4OT erhöht | — | ||
IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861. | ||||
| CVE-2020-4602US | medium4.4 | — | ||
IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836. | ||||
| CVE-2020-4600US | medium5.3 | — | ||
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informat… | ||||
| CVE-2020-4599US | medium5.3 | — | ||
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informat… | ||||
| CVE-2020-4597US | medium4.3OT erhöht | — | ||
IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:… | ||||
| CVE-2020-4596US | high7.5OT erhöht | — | ||
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184812… | ||||
| CVE-2020-4595US | high7.5OT erhöht | — | ||
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184819… | ||||
| CVE-2020-4594US | high7.5OT erhöht | — | ||
IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184800… | ||||
| CVE-2020-15168US | medium5.3 | — | ||
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError wo… | ||||
| CVE-2020-24553US | medium6.1 | — | ||
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. | ||||
| CVE-2020-8244US | medium6.5 | — | ||
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() arg… | ||||
| CVE-2020-4166US | medium5.3 | — | ||
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informat… | ||||
| CVE-2020-16845US | high7.5 | — | ||
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. | ||||
| CVE-2020-15778US | high7.4 | Exploit | ||
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedl… | ||||
| CVE-2020-15586US | medium5.9 | — | ||
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and write… | ||||
| CVE-2020-14039US | medium5.3 | — | ||
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the instal… | ||||
| CVE-2020-14145US | medium5.9 | — | ||
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to tar… | ||||
| CVE-2020-7608US | medium5.3 | — | ||
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2021:0521 vom 2021-02-15external
- Red Hat Security Advisory RHSA-2021:0548 vom 2021-02-16external
- Ubuntu Security Notice USN-4758-1 vom 2021-03-09external
- WID-SEC-W-2023-1599 - CSAF Versionself
- WID-SEC-2023-1599 - Portal Versionself
- IBM Security Bulletin: 6403463 vom 2021-01-13external
- IBM Security Bulletin 7008449 vom 2023-06-29external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan