Advisories · Technology

IBM Security Key Lifecycle Manager.

Every CVE that names IBM Security Key Lifecycle Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-25684 CVE record

CVSS 6.5 Medium

IBM Security Key Lifecycle Manager SQL injection
- IBM Security Key Lifecycle Manager
- SQL injection
Not analysed yet 21 Mar 2023
CVE-2023-25686 CVE record

CVSS 6.2 Medium

IBM Security Key Lifecycle Manager information disclosure
- IBM Security Key Lifecycle Manager
Not analysed yet 21 Mar 2023
CVE-2023-25923 CVE record

CVSS 2.7 Low

IBM Security Key Lifecycle Manager denial of service
- IBM Security Key Lifecycle Manager
- Broken access control
Not analysed yet 21 Mar 2023
CVE-2023-25688 CVE record

CVSS 4.3 Medium

IBM Security Key Lifecycle Manager information disclosure
- IBM Security Key Lifecycle Manager
- Path traversal
Not analysed yet 21 Mar 2023
CVE-2023-25687 CVE record

CVSS 4.3 Medium

IBM Security Key Lifecycle Manager information disclosure
- IBM Security Key Lifecycle Manager
- Information disclosure
Not analysed yet 21 Mar 2023
CVE-2023-25924 CVE record

CVSS 5.4 Medium

IBM Security Key Lifecycle Manager improper authorization
- IBM Security Key Lifecycle Manager
- Broken access control
Not analysed yet 21 Mar 2023
CVE-2023-25689 CVE record

CVSS 2.7 Low

IBM Security Key Lifecycle Manager information disclosure
- IBM Security Key Lifecycle Manager
- Path traversal
Not analysed yet 21 Mar 2023
CVE-2021-38980 CVE record

CVSS 2.7 Low

IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error m…
- IBM Security Key Lifecycle Manager
Not analysed yet 23 Nov 2021
CVE-2021-38984 CVE record

CVSS 3.7 Low

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38983 CVE record

CVSS 4.4 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38982 CVE record

CVSS 5.4 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38981 CVE record

CVSS 5.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38979 CVE record

CVSS 4.4 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a sa…
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38978 CVE record

CVSS 5.9 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38977 CVE record

CVSS 3.1 Low

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38976 CVE record

CVSS 6.2 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38975 CVE record

CVSS 4.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38974 CVE record

CVSS 5.4 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests.
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Nov 2021
CVE-2021-38985 CVE record

CVSS 4.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the…
- IBM Security Key Lifecycle Manager
Not analysed yet 12 Nov 2021
CVE-2021-38973 CVE record

CVSS 2.4 Low

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the…
- IBM Security Key Lifecycle Manager
Not analysed yet 12 Nov 2021
CVE-2021-38972 CVE record

CVSS 4.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the…
- IBM Security Key Lifecycle Manager
Not analysed yet 12 Nov 2021
CVE-2020-4846 CVE record

CVSS 2.7 Low

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain…
- IBM Security Key Lifecycle Manager
Not analysed yet 17 Dec 2020
CVE-2020-4845 CVE record

CVSS 5.4 Medium

IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting.
- IBM Security Key Lifecycle Manager
Not analysed yet 17 Dec 2020
CVE-2020-4568 CVE record

CVSS 6.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user.
- IBM Security Key Lifecycle Manager
Not analysed yet 10 Nov 2020
CVE-2020-4574 CVE record

CVSS 7.4 High

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- IBM Security Key Lifecycle Manager
Not analysed yet 29 Jul 2020
CVE-2020-4573 CVE record

CVSS 5.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests.
- IBM Security Key Lifecycle Manager
Not analysed yet 29 Jul 2020
CVE-2020-4572 CVE record

CVSS 5.3 Medium

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
- IBM Security Key Lifecycle Manager
Not analysed yet 29 Jul 2020
CVE-2020-4569 CVE record

CVSS 6.5 Medium

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypass…
- IBM Security Key Lifecycle Manager
Not analysed yet 29 Jul 2020
CVE-2020-4567 CVE record

CVSS 8.6 High

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- IBM Security Key Lifecycle Manager
Not analysed yet 29 Jul 2020
CVE-2019-4564 CVE record

CVSS 6.1 Medium

IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Oct 2019
CVE-2019-4514 CVE record

CVSS 5.3 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0…
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Oct 2019
CVE-2019-4566 CVE record

CVSS 6.2 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in…
- IBM Security Key Lifecycle Manager
Not analysed yet 24 Sept 2019
CVE-2019-4515 CVE record

CVSS 4.3 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request…
- IBM Security Key Lifecycle Manager
Not analysed yet 24 Sept 2019
CVE-2019-4565 CVE record

CVSS 5.9 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have…
- IBM Security Key Lifecycle Manager
Not analysed yet 20 Sept 2019
CVE-2018-1751 CVE record

CVSS 5.9 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected…
- IBM Security Key Lifecycle Manager
Not analysed yet 23 Jan 2019
CVE-2018-1747 CVE record

CVSS 7.1 High

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7…
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Oct 2018
CVE-2018-1744 CVE record

CVSS 7.7 High

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7…
- IBM Security Key Lifecycle Manager
Not analysed yet 15 Oct 2018
CVE-2018-1745 CVE record

CVSS 7.5 High

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to…
- IBM Security Key Lifecycle Manager
Not analysed yet 11 Oct 2018
CVE-2018-1738 CVE record

CVSS 7.1 High

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 2.6, 2.7…
- IBM Security Key Lifecycle Manager
Not analysed yet 11 Oct 2018
CVE-2018-1753 CVE record

CVSS 4.3 Medium

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data.
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2018-1750 CVE record

CVSS 4.2 Medium

IBM Security Key Lifecycle Manager: IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical…
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2018-1749 CVE record

CVSS 4.3 Medium

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and…
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2018-1743 CVE record

CVSS 5.3 Medium

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users.
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2018-1742 CVE record

CVSS 5.9 Medium

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication t…
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2018-1741 CVE record

CVSS 6.5 Medium

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other c…
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Oct 2018
CVE-2017-1671 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system.
- IBM Security Key Lifecycle Manager
Not analysed yet 9 Jan 2018
CVE-2017-1670 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection.
- IBM Security Key Lifecycle Manager
Not analysed yet 9 Jan 2018
CVE-2017-1668 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
- IBM Security Key Lifecycle Manager
Not analysed yet 9 Jan 2018
CVE-2017-1666 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.
- IBM Security Key Lifecycle Manager
Not analysed yet 9 Jan 2018
CVE-2017-1727 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the system.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2017-1673 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2017-1672 CVE record

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the w…
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2017-1669 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2017-1665 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2017-1664 CVE record

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- IBM Security Key Lifecycle Manager
Not analysed yet 4 Jan 2018
CVE-2016-6098 CVE record

IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Jun 2017
CVE-2016-6093 CVE record

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- IBM Security Key Lifecycle Manager
Not analysed yet 8 Jun 2017