Threat database

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to inject arbitrary JavaScript code into the web user interface, potentially altering its intended functionality and leading to credential disclosure within a trusted session. The vulnerability has a medium severity rating with a CVSS score of 5.4.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a heap-based out-of-bounds read vulnerability in the TDS7 LOGIN7 protocol parser. This flaw allows a remote attacker to send a specially crafted TDS LOGIN7 packet with invalid offset or length values, potentially leading to information disclosure or denial of service. The vulnerability has a high severity rating with a CVSS score of 8.1. No patch or remediation information is currently provided.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a heap-based buffer overflow vulnerability in the MongoDB protocol parser. This flaw arises when a remote attacker sends a specially crafted MongoDB SCRAM username with excessive length, leading to memory corruption. The vulnerability can result in denial of service or arbitrary code execution. The CVSS score is 8.1, indicating high severity.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a heap-based buffer overflow vulnerability in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can exploit this by sending crafted TDS login fragments that exceed the fixed-size buffer, potentially causing denial of service or arbitrary code execution.

IBM Guardium Data Protection 12.2 contains a critical stored cross-site scripting (XSS) vulnerability in the Quick Search results grid. This vulnerability allows an unauthenticated attacker who can influence monitored database traffic to execute malicious scripts in the browser of an authenticated user. The vulnerability has a CVSS score of 9.3, indicating a high impact on confidentiality and integrity. No patch or remediation information is currently provided.

IBM Guardium Data Protection version 12.2 contains a local privilege escalation vulnerability in the cp_wrapper component. This flaw allows a low-privileged local user to gain root privileges, potentially enabling unauthorized access or modification of sensitive system files. The vulnerability is classified under improper privilege management (CWE-269).

IBM Guardium Data Protection version 12.2 contains a vulnerability involving the use of hard-coded credentials and weak cryptographic protection in the pkcrypto passkey component. This flaw allows a local attacker to recover the root password and escalate privileges to root. The vulnerability has a high severity rating with a CVSS score of 8.4.

IBM Guardium Data Protection version 12.2 contains a race condition vulnerability in its patch installer that allows signature verification bypass. This flaw can be exploited by a local attacker to execute arbitrary code with root privileges, leading to full system compromise. The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). It has a high severity with a CVSS score of 7.8. No patch or official remediation information is currently provided. No known exploits are reported in the wild.

IBM Guardium Data Protection versions 12.1 and 12.2.2 contain a critical vulnerability in the edge-controller component due to missing authentication. This flaw allows an unauthenticated remote attacker to execute arbitrary container images, potentially gaining control over managed edge clusters. The vulnerability is identified as CWE-306 and has a CVSS 3.1 score of 9.8, indicating a critical severity level.

IBM Guardium Data Protection version 12.2.2 logs sensitive credentials such as SECRET and API_KEY at INFO level in edge-controller and edge-manager components. An authenticated attacker with access to these logs could retrieve these credentials and potentially impersonate services or access the Guardium control plane without authorization. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 score of 6.5 (medium severity).

IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability in its GIM file-upload functionality. This flaw allows an unauthenticated attacker to write arbitrary files to the Collector system. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 7.5, indicating high severity. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

IBM Guardium Data Protection version 12.2.2 contains a denial-of-service vulnerability in its edge-controller component. An unauthenticated remote attacker with network access to the edge-controller's gRPC service can send malformed task data that triggers an unchecked type assertion, causing the edge-controller process to crash unexpectedly. This results in service disruption without impacting confidentiality or integrity.

IBM Guardium Data Protection 12.2 contains a command injection vulnerability in the SUID-root ssh_config_wrapper component. This flaw allows an authenticated high-privileged user to inject arbitrary commands, which are executed with root privileges. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a vulnerability in the WfpMonitor kernel driver where certain IOCTL handlers improperly validate user-supplied pointers. This flaw can allow a privileged local attacker to cause a system crash or perform limited kernel-memory reads.

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a heap-based buffer overflow vulnerability due to improper bounds checking. This flaw allows an unauthenticated remote attacker to overflow the buffer and execute arbitrary code on the affected system. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-13257 is a vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It allows an authenticated user to forge signature requests due to insufficient verification of data authenticity. The vulnerability has a medium severity with a CVSS score of 6.5, indicating a moderate impact on integrity without affecting confidentiality or availability.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.