IBM Security Guardium vulnerabilities

112 CVEs affecting IBM Security Guardium, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-25029, published 2025-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4292, published 2019-07-02. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable web server. IBM X-Force ID: 160698.
CVE-2020-4180, published 2020-06-03. High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days. IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this…
CVE-2021-20557, published 2021-05-24. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 199184.
CVE-2020-4689, published 2020-10-12. Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM…
CVE-2017-1253, published 2017-07-05. Critical severity, CVSS 9.9. EPSS: 2.3% chance of exploitation in the next 30 days. IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this…
CVE-2021-20385, published 2021-05-24. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this…
CVE-2017-1597, published 2018-12-17. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for…
CVE-2020-4952, published 2021-01-27. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-Force ID: 192028.
CVE-2017-1269, published 2017-07-05. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete…
CVE-2019-4422, published 2019-10-03. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. IBM X-Force ID: 162768.

Latest

CVE-2025-25029, published 2025-05-28. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.
CVE-2025-25026, published 2025-05-28. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.
CVE-2025-25025, published 2025-05-28. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further…
CVE-2025-3440, published 2025-05-15. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2025-25023, published 2025-04-09. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.
CVE-2024-49336, published 2024-12-19. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to…
CVE-2023-47710, published 2024-05-24. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2023-47717, published 2024-05-16. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Guardium 12.0 could allow a privileged user to perform unauthorized actions that could lead to a denial of service. IBM X-Force ID: 271690.
CVE-2023-47712, published 2024-05-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X-Force ID: 271527.
CVE-2023-47711, published 2024-05-14. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 271526.