Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84031] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84064] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84070] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84071] IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector p…

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in arbitrary command execution with root-level privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84073] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84074] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-82892] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81669] IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create c…

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81937] IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import r…

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root privileges and impact to the confidentiality, integrity, and availability of the affected system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-82340] IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and atta…

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-82832] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-82887] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-80442] IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerabili…

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-81657] IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary…

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61820] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61821] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-61781] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61817] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder fu…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61818] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that inv…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61819] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the lite…

nvdaltovulnerabilidad CVSS 8.5 NVD