Guardium Data Protection
by IBM
CVEs (61)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-82885 | Hig | 0.57 | 8.8 | 0.01 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API. | ||
| CVE-2026-81933 | Hig | 0.57 | 8.8 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to… | ||
| CVE-2026-81656 | Hig | 0.57 | 8.8 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data… | ||
| CVE-2026-81626 | Hig | 0.56 | 8.6 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact… | ||
| CVE-2026-84842 | Hig | 0.53 | 8.1 | — | Sep 29, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity. | ||
| CVE-2026-84241 | Hig | 0.53 | 8.1 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization. | ||
| CVE-2026-84108 | Hig | 0.53 | 8.1 | 0.01 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation. | ||
| CVE-2026-84085 | Hig | 0.53 | 8.1 | 0.01 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command. | ||
| CVE-2026-84081 | Hig | 0.53 | 8.1 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation. | ||
| CVE-2026-84077 | Hig | 0.53 | 8.1 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability. | ||
| CVE-2026-82892 | Hig | 0.53 | 8.1 | 0.01 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||
| CVE-2026-84089 | Hig | 0.51 | 7.8 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. | ||
| CVE-2026-84083 | Hig | 0.51 | 7.8 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute… | ||
| CVE-2026-82893 | Hig | 0.51 | 7.8 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. | ||
| CVE-2026-84105 | Hig | 0.50 | 7.7 | 0.00 | Sep 18, 2026 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command. | ||
| CVE-2026-84440 | Hig | 0.49 | 7.5 | — | Sep 29, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter… | ||
| CVE-2026-84882 | Hig | 0.49 | 7.5 | 0.00 | Sep 25, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system. | ||
| CVE-2026-85029 | Hig | 0.49 | 7.5 | 0.01 | Sep 25, 2026 | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory. | ||
| CVE-2026-84893 | Hig | 0.49 | 7.6 | 0.00 | Sep 25, 2026 | IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database. | ||
| CVE-2026-84884 | Hig | 0.49 | 7.5 | 0.00 | Sep 25, 2026 | IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token. |
- risk 0.57cvss 8.8epss 0.01
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.
- risk 0.57cvss 8.8epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to…
- risk 0.57cvss 8.8epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data…
- risk 0.56cvss 8.6epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact…
- risk 0.53cvss 8.1epss —
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity.
- risk 0.53cvss 8.1epss 0.00
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
- risk 0.53cvss 8.1epss 0.01
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- risk 0.53cvss 8.1epss 0.01
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- risk 0.53cvss 8.1epss 0.00
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.
- risk 0.53cvss 8.1epss 0.00
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.
- risk 0.53cvss 8.1epss 0.01
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- risk 0.51cvss 7.8epss 0.00
IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.
- risk 0.51cvss 7.8epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute…
- risk 0.51cvss 7.8epss 0.00
IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.
- risk 0.50cvss 7.7epss 0.00
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- risk 0.49cvss 7.5epss —
IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter…
- risk 0.49cvss 7.5epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system.
- risk 0.49cvss 7.5epss 0.01
IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory.
- risk 0.49cvss 7.6epss 0.00
IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.
- risk 0.49cvss 7.5epss 0.00
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.
Page 2 of 4