Low severity · published Oct 22, 2016
CVE-2016-0240
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism,…
3.7
CVSS
1%
EPSS
No
On KEV
Description
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Security Guardium Database Activity Monitor · Ibm
8.2; 9.0; 9.1; 9.5; 10.0; 10.1; +1 more · source: NVD
Affected product
SG
Security Guardium Database Activity Monitor
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0240
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21990232
www.securityfocus.com
http://www.securityfocus.com/bid/93836
More from Security Guardium Database Activity Monitor
9.8
CVE-2017-1601
IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier…
8.8
CVE-2016-0241
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof…
8.8
CVE-2016-0239
IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with…
8.8
CVE-2016-0236
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to execute…
8.2
CVE-2016-0235
IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB…