IBM Security Guardium
106 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-3473 | 12.1 | IBM Security Guardium privilege escalation | MEDIUM 6.7 | 0.1 % | ||
| CVE-2025-25029 | 12.0 | IBM Security Guardium information disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-25026 | 12.0 | IBM Security Guardium information disclosure | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-25025 | 12.0 | IBM Security Guardium information disclosure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-3440 | 11.5 | IBM Security Guardium cross-site scripting | MEDIUM 5.5 | 0.3 % | ||
| CVE-2025-25023 | 11.4, 12.1 | IBM Security Guardium information disclosure | MEDIUM 4.9 | 0.4 % | ||
| CVE-2024-49336 | 11.5, 12.0 | IBM Security Guardium server-side request forgery | MEDIUM 6.5 | 0.2 % | ||
| CVE-2023-47710 | 11.4, 11.5, 12.0 | IBM Security Guardium cross-site scripting | MEDIUM 5.4 | 0.2 % | ||
| CVE-2023-47717 | 12.0 | IBM Security Guardium denial of service | MEDIUM 4.4 | 0.2 % | ||
| CVE-2023-47711 | 11.3, 11.4, 11.5, 12.0 | IBM Security Guardium denial of service | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-47712 | 11.3, 11.4, 11.5, 12.0 | IBM Security Guardium privilege escalation | HIGH 7.8 | 0.2 % | ||
| CVE-2023-47709 | 11.3, 11.4, 11.5, 12.0 | IBM Security Guardium command injection | CRITICAL 9.1 | 1.0 % | ||
| CVE-2023-42004 | 11.3, 11.4, 11.5 | IBM Security Guardium CSV injection | HIGH 8.8 | 1.1 % | ||
| CVE-2022-43906 | 11.5 | IBM Security Guardium information disclosure | MEDIUM 5.3 | 0.5 % | ||
| CVE-2022-43903 | 10.6, 11.3, 11.4 | IBM Security Guardium denial of service | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-43904 | 11.3, 11.4 | IBM Security Guardium information disclosure | HIGH 7.5 | 0.8 % | ||
| CVE-2023-33852 | 11.4 | IBM Security Guardium SQL injection | HIGH 7.6 | 0.6 % | ||
| CVE-2022-43909 | 11.4 | IBM Security Guardium cross-site scripting | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-43907 | 11.4 | IBM Security Guardium command execution | HIGH 8.8 | 1.3 % | ||
| CVE-2023-30437 | 11.3, 11.4, 11.5 | IBM Security Guardium information disclosure | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-30436 | 11.3, 11.4, 11.5 | IBM Security Guardium cross-site scripting | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-30435 | 11.3, 11.4, 11.5 | IBM Security Guardium cross-site scripting | HIGH 8.9 | 0.4 % | ||
| CVE-2023-35893 | 10.6, 11.3, 11.4, 11.5 | IBM Security Guardium command execution | CRITICAL 9.9 | 1.4 % | ||
| CVE-2022-43910 | 11.3 | IBM Security Guardium privilege escalation | HIGH 8.4 | 0.2 % | ||
| CVE-2022-43908 | 11.3 | IBM Security Guardium denial of service | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-22307 | 11.3, 11.4, 11.5 | IBM Security Guardium privilege escalation | HIGH 7.8 | 0.2 % | ||
| CVE-2023-0041 | 11.5 | IBM Security Guardium session fixation | HIGH 8.8 | 0.5 % | ||
| CVE-2022-39166 | 11.4 | IBM Security Guardium information disclosure | MEDIUM 4.9 | 0.6 % | ||
| CVE-2021-39077 | 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, 11.4 | IBM Security Guardium information disclosure | MEDIUM 4.4 | 0.1 % | ||
| CVE-2021-39074 | 11.4 | IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 6.1 | 0.6 % | ||
| CVE-2021-39078 | 10.5 | IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589. | MEDIUM 4.4 | 0.1 % | ||
| CVE-2021-39076 | 10.5 ; 11.3 | IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive inf | HIGH 7.5 | 0.6 % | ||
| CVE-2021-39072 | 11.3 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri | MEDIUM 5.9 | 1.3 % | ||
| CVE-2021-29735 | 10.5 ; 10.6 ; 11.0 ; … | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-20377 | 11.3 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned | LOW 2.7 | 1.0 % | ||
| CVE-2020-4690 | 11.3 | IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe | CRITICAL 9.8 | 1.1 % | ||
| CVE-2021-29773 | 10.6 ; 11.3 | IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details cause | MEDIUM 5.4 | 0.7 % | ||
| CVE-2021-20433 | 11.3 | IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against | MEDIUM 6.5 | 0.9 % | ||
| CVE-2021-20427 | 11.2 | IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. | HIGH 7.5 | 1.3 % | ||
| CVE-2021-20420 | 11.2 | IBM Security Guardium 11.2 could disclose sensitive information due to reliance on untrusted inputs that could aid in further attacks agains | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-20418 | 11.2 | IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compr | CRITICAL 9.8 | 1.0 % | ||
| CVE-2021-20557 | 11.2 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially cr | HIGH 7.2 | 2.7 % | ||
| CVE-2021-20428 | 11.2 | IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-20426 | 11.2 | IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe | CRITICAL 9.8 | 1.0 % | ||
| CVE-2021-20419 | 11.2 | IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor | HIGH 7.5 | 0.7 % | ||
| CVE-2021-20389 | 11.2 | IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770. | HIGH 7.8 | 0.2 % | ||
| CVE-2021-20386 | 11.2 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-20385 | 11.2 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-c | HIGH 8.4 | 2.1 % | ||
| CVE-2020-4990 | 11.2 | IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow | HIGH 8.8 | 1.1 % | ||
| CVE-2020-4184 | 11.2 | IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weak | HIGH 7.3 | 0.9 % | ||
| CVE-2020-4952 | 11.2 | IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-Force ID: 192028. | HIGH 8.8 | 2.0 % | ||
| CVE-2020-4189 | 11.2 | IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. | MEDIUM 4.3 | 0.7 % | ||
| CVE-2020-4921 | 10.6 ; 11.2 | IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which cou | HIGH 8.8 | 1.5 % | ||
| CVE-2020-4688 | 10.6 ; 11.2 | IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused | HIGH 7.8 | 0.9 % | ||
| CVE-2020-4689 | 11.2 | IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caus | MEDIUM 6.8 | 2.4 % | ||
| CVE-2020-4681 | 11.2 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-4680 | 11.2 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-4679 | 11.2 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 4.8 | 0.6 % | ||
| CVE-2020-4678 | 11.2 | IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. I | MEDIUM 4.9 | 1.2 % | ||
| CVE-2018-1501 | 10.5 ; 10.6 ; 11.0 | IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls | HIGH 7.5 | 1.1 % | ||
| CVE-2020-4186 | 10.5 ; 10.6 ; 11.1 | IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against | MEDIUM 5.3 | 1.1 % | ||
| CVE-2020-4185 | 10.5 ; 10.6 ; 11.1 | IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly | HIGH 7.5 | 0.8 % | ||
| CVE-2020-4188 | 10.6 ; 11.1 | IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable numb | MEDIUM 5.3 | 1.1 % | ||
| CVE-2020-4193 | 11.1 | IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. | CRITICAL 9.8 | 1.4 % | ||
| CVE-2020-4191 | 11.1 | IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor | MEDIUM 4.4 | 0.2 % | ||
| CVE-2020-4183 | 11.1 | IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-4307 | 11.1 | IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service at | MEDIUM 6.5 | 0.5 % | ||
| CVE-2020-4190 | 10.6 ; 11.0 ; 11.1 | IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its o | MEDIUM 6.7 | 0.2 % | ||
| CVE-2020-4187 | 11.1 | IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM | MEDIUM 5.3 | 1.1 % | ||
| CVE-2020-4182 | 11.1 | IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-4180 | 11.1 | IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-c | HIGH 8.8 | 3.0 % | ||
| CVE-2020-4177 | 11.1 | IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe | CRITICAL 9.8 | 1.0 % | ||
| CVE-2019-4422 | 9.0 ; 9.5 ; 10.6 | IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the acce | HIGH 8.8 | 1.7 % | ||
| CVE-2019-4292 | 10.5 | IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code | HIGH 8.8 | 3.7 % | ||
| CVE-2018-1891 | 10 ; 10.5 | IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code | MEDIUM 5.4 | 1.0 % | ||
| CVE-2018-1889 | 10 ; 10.5 | IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod | MEDIUM 5.4 | 1.0 % | ||
| CVE-2017-1597 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have | HIGH 7.5 | 2.0 % | ||
| CVE-2017-1272 | 10 ; 10.5 | IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized | MEDIUM 5.3 | 1.7 % | ||
| CVE-2017-1265 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This | MEDIUM 5.9 | 0.8 % | ||
| CVE-2018-1818 | 10 ; 10.5 | IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboun | CRITICAL 9.8 | 0.8 % | ||
| CVE-2018-1817 | 10 ; 10.5 | IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code | MEDIUM 6.1 | 0.9 % | ||
| CVE-2017-1268 | 10 ; 10.5 | IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but | HIGH 7.5 | 1.3 % | ||
| CVE-2018-1509 | 10.5 | IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spo | HIGH 7.4 | 0.9 % | ||
| CVE-2018-1498 | 10.5 | IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 14122 | HIGH 7.8 | 0.4 % | ||
| CVE-2017-1255 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker | HIGH 7.5 | 1.0 % | ||
| CVE-2018-1368 | 9.0 ; 9.1 ; 9.5 | IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perf | MEDIUM 4.4 | 0.3 % | ||
| CVE-2017-1757 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow | HIGH 8.8 | 1.6 % | ||
| CVE-2017-1600 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra | MEDIUM 5.4 | 0.5 % | ||
| CVE-2017-1598 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decr | HIGH 7.5 | 0.8 % | ||
| CVE-2017-1596 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vec | MEDIUM 5.5 | 0.3 % | ||
| CVE-2017-1595 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vec | MEDIUM 5.5 | 0.3 % | ||
| CVE-2017-1270 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijackin | LOW 3.3 | 0.3 % | ||
| CVE-2017-1266 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified | MEDIUM 5.4 | 0.5 % | ||
| CVE-2017-1262 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specia | MEDIUM 6.1 | 1.3 % | ||
| CVE-2017-1261 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736. | LOW 3.3 | 0.3 % | ||
| CVE-2017-1257 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on th | MEDIUM 4.3 | 1.1 % | ||
| CVE-2017-1271 | 9.0 ; 9.1 ; 9.5 | IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm sh | HIGH 7.5 | 0.8 % | ||
| CVE-2017-1267 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integri | HIGH 7.5 | 1.6 % | ||
| CVE-2017-1264 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resourc | HIGH 7.5 | 1.5 % | ||
| CVE-2017-1254 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could e | HIGH 7.1 | 1.6 % | ||
| CVE-2017-1253 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-c | CRITICAL 9.9 | 2.3 % | ||
| CVE-2017-1269 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which cou | CRITICAL 9.8 | 1.9 % | ||
| CVE-2017-1258 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous use | MEDIUM 6.5 | 1.1 % | ||
| CVE-2017-1256 | 10.0 ; 10.0.1 ; 10.1 ; … | IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i | MEDIUM 6.1 | 0.8 % | ||
| CVE-2016-0238 | 9.0 ; 9.1 ; 10.0 ; … | IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an a | LOW 3.7 | 0.9 % | ||
| CVE-2017-1122 | 8.2, 9.0, 9.1, 10.0, 10, 9.5, 10.0.1, 10.1, 10.1.2 | IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary comm | HIGH 7.4 | 0.3 % |