CVE-2019-4330

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-565

Affected software

Vendor	Product	Versions
IBM	Security Guardium Big Data Intelligence	4

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/161210VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/1096384Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/161210VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/1096384Patch, Vendor Advisory

Timeline

Published: Oct 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-43344.3IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against CVE-2019-43355.5IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 1 CVE-2019-43369.8IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to CVE-2019-43375.3IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentica CVE-2019-43387.5IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or in CVE-2019-43397.5IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2019-43408.2IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML CVE-2019-43425.4IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code CVE-2019-43436.5IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private CVE-2019-43493.5IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could CVE-2019-43514.6IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: CVE-2019-43522.4IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.