IBM Security Key Lifecycle Manager vulnerabilities
70 vulnerabilities
Known vulnerabilities in IBM Security Key Lifecycle Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-1738ibmsecurity_key_lifecycle_manager
EPSS score1.10%
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper authentication mechanisms. IBM X-Force ID: 147907.CVE-2018-1742ibmsecurity_key_lifecycle_managerEPSS score0.30%
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 148421.CVE-2018-1749ibmsecurity_key_lifecycle_managerEPSS score0.90%
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484.CVE-2018-1743ibmsecurity_key_lifecycle_managerEPSS score1.30%
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 148422.CVE-2018-1750ibmsecurity_key_lifecycle_managerEPSS score0.68%
IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 148511.CVE-2018-1747ibmsecurity_key_lifecycle_managerEPSS score1.85%
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.CVE-2018-1751ibmsecurity_key_lifecycle_managerEPSS score1.32%
IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 148512.CVE-2018-1744ibmsecurity_key_lifecycle_managerEPSS score2.56%
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 148423.CVE-2018-1741ibmsecurity_key_lifecycle_managerEPSS score1.27%
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. IBM X-Force ID: 148420.CVE-2018-1753ibmsecurity_key_lifecycle_managerEPSS score0.98%
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 148514.CVE-2018-1745ibmsecurity_key_lifecycle_managerEPSS score3.89%
IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. IBM X-Force ID: 148424.CVE-2021-38976ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.24%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.CVE-2021-38983ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.91%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 212792.CVE-2021-38977ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.53%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.CVE-2021-38975ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.97%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 212780.CVE-2021-38974ibmsecurity_guardium_key_lifecycle_manager+1EPSS score1.00%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779.CVE-2021-38980ibmsecurity_guardium_key_lifecycle_manager+1EPSS score1.23%
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212786.CVE-2021-38972ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.63%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.CVE-2021-38985ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.63%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.CVE-2021-38978ibmsecurity_guardium_key_lifecycle_manager+1EPSS score0.89%
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 212783.