Security Key Lifecycle Manager (Ibm) - vulnerabilities (CVEs)

70 CVEs, 0 in the last 30 days, 86 known versions, newest CVE from 2023-03-22. Vendor: Ibm.

CVEs of Security Key Lifecycle Manager

CVE-2023-25688 - CVSS 5.3 (medium), 2023-03-22: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker…
CVE-2023-25924 - CVSS 8.8 (high), 2023-03-22: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have…
CVE-2023-25684 - CVSS 9.8 (critical), 2023-03-21: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL…
CVE-2023-25686 - CVSS 6.2 (medium), 2023-03-21: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM…
CVE-2023-25923 - CVSS 7.5 (high), 2023-03-21: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service…
CVE-2023-25689 - CVSS 5.3 (medium), 2023-03-21: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker…
CVE-2023-25687 - CVSS 4.3 (medium), 2023-03-21: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files.…
CVE-2021-38980 - CVSS 5.3 (medium), 2021-11-23: IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive…
CVE-2021-38982 - CVSS 5.4 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2021-38981 - CVSS 5.3 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error…
CVE-2021-38984 - CVSS 7.5 (high), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…
CVE-2021-38983 - CVSS 7.5 (high), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…
CVE-2021-38978 - CVSS 5.9 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly…
CVE-2021-38974 - CVSS 6.5 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP…
CVE-2021-38977 - CVSS 4.3 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able…
CVE-2021-38976 - CVSS 6.2 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.
CVE-2021-38979 - CVSS 7.5 (high), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a…
CVE-2021-38975 - CVSS 6.5 (medium), 2021-11-15: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP…
CVE-2021-38985 - CVSS 4.3 (medium), 2021-11-12: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the…
CVE-2021-38972 - CVSS 4.3 (medium), 2021-11-12: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the…
CVE-2021-38973 - CVSS 2.7 (low), 2021-11-12: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the…
CVE-2020-4846 - CVSS 2.7 (low), 2020-12-17: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is…
CVE-2020-4845 - CVSS 5.4 (medium), 2020-12-17: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2020-4568 - CVSS 6.3 (medium), 2020-11-10: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157.
CVE-2020-4572 - CVSS 5.3 (medium), 2020-07-29: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is…
CVE-2020-4569 - CVSS 6.5 (medium), 2020-07-29: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified…
CVE-2020-4574 - CVSS 7.5 (high), 2020-07-29: IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…
CVE-2020-4567 - CVSS 9.8 (critical), 2020-07-29: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account…
CVE-2020-4573 - CVSS 5.3 (medium), 2020-07-29: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180.
CVE-2019-4564 - CVSS 6.1 (medium), 2019-10-04: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
CVE-2019-4514 - CVSS 5.3 (medium), 2019-10-04: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be used to mount…
CVE-2019-4566 - CVSS 6.2 (medium), 2019-09-24: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627.
CVE-2019-4515 - CVSS 6.5 (medium), 2019-09-24: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2019-4565 - CVSS 7.5 (high), 2019-09-20: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to…
CVE-2018-1751 - CVSS 7.5 (high), 2019-01-23: IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…
CVE-2018-1744 - CVSS 7.7 (high), 2018-10-15: IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2018-1747 - CVSS 7.1 (high), 2018-10-15: IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote…
CVE-2018-1745 - CVSS 7.5 (high), 2018-10-11: IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. IBM X-Force ID:…
CVE-2018-1738 - CVSS 7.1 (high), 2018-10-11: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due…
CVE-2018-1753 - CVSS 4.3 (medium), 2018-10-08: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated…
CVE-2018-1750 - CVSS 8.1 (high), 2018-10-08: IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by…
CVE-2018-1749 - CVSS 6.5 (medium), 2018-10-08: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls…
CVE-2018-1743 - CVSS 5.3 (medium), 2018-10-08: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks…
CVE-2018-1742 - CVSS 9.3 (critical), 2018-10-08: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2018-1741 - CVSS 6.5 (medium), 2018-10-08: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of…
CVE-2014-0872 - CVSS 4.1 (medium), 2018-04-25: The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive…
CVE-2017-1671 - CVSS 7.5 (high), 2018-01-09: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2017-1670 - CVSS 9.8 (critical), 2018-01-09: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could…
CVE-2017-1668 - CVSS 6.1 (medium), 2018-01-09: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a…
CVE-2017-1666 - CVSS 8.1 (high), 2018-01-09: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker…
CVE-2017-1669 - CVSS 3.7 (low), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized…
CVE-2017-1727 - CVSS 4.3 (medium), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the…
CVE-2017-1665 - CVSS 5.9 (medium), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…
CVE-2017-1673 - CVSS 6.1 (medium), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code…
CVE-2017-1664 - CVSS 5.9 (medium), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…
CVE-2017-1672 - CVSS 8.8 (high), 2018-01-04: IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized…
CVE-2016-6098 - CVSS 8.1 (high), 2017-06-08: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or…
CVE-2016-6093 - CVSS 9.8 (critical), 2017-06-08: IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…
CVE-2016-6102 - CVSS 3.7 (low), 2017-03-27: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties…
CVE-2016-6096 - CVSS 6.1 (medium), 2017-02-07: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code…
CVE-2016-6094 - CVSS 4.3 (medium), 2017-02-07: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or…
CVE-2016-6104 - CVSS 7.2 (high), 2017-02-07: IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions,…
CVE-2016-6092 - CVSS 6.2 (medium), 2017-02-07: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
CVE-2016-6097 - CVSS 4 (medium), 2017-02-07: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system.
CVE-2016-6095 - CVSS 9.8 (critical), 2017-02-02: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVE-2016-6116 - CVSS 5.9 (medium), 2017-02-02: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP…
CVE-2016-6103 - CVSS 8.8 (high), 2017-02-02: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized…
CVE-2016-6099 - CVSS 5.3 (medium), 2017-02-02: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on…
CVE-2016-6117 - CVSS 5.3 (medium), 2017-02-01: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information.
CVE-2016-6105 - CVSS 8.2 (high), 2017-02-01: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access…