Threats affecting pkg:maven/com.ibm/guardium_data_protection

IBM Guardium Data Protection versions 12.1 and 12.2 contain a vulnerability due to the use of a hard-coded cryptographic key. This flaw could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-321 and has a high severity rating with a CVSS score of 8.1.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code. The vulnerability is due to improper size checking during buffer copy operations. It has a high severity with a CVSS score of 8.1. No patch or remediation details are provided in the available data.

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.

IBM Guardium Data Protection version 12.2 contains a vulnerability involving the use of hard-coded credentials and weak cryptographic protection in the pkcrypto passkey component. This flaw allows a local attacker to recover the root password and escalate privileges to root. The vulnerability has a high severity rating with a CVSS score of 8.4.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.