CVE-2017-1601

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ibm.com/support/docview.wss?uid=swg22014230Patch, Vendor Advisory
http://www.securitytracker.com/id/1040899Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/132624VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22014230Patch, Vendor Advisory
http://www.securitytracker.com/id/1040899Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/132624VDB Entry, Vendor Advisory

Timeline

Published: May 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160106.1i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will CVE-2017-160137.5hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught CVE-2017-160147.5Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash CVE-2017-160156.1Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the applicati CVE-2017-160166.1Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (X CVE-2017-160176.1sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.CVE-2017-160186.1Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can CVE-2017-160196.1GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-CVE-2017-16024.3IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they shou CVE-2017-160209.8Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary CVE-2017-160216.5uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not CVE-2017-160226.1Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5