Ibm Security Key Lifecycle Manager vulnerabilities
70 known vulnerabilities affecting ibm/security_key_lifecycle_manager.
Total CVEs
70
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL6HIGH19MEDIUM41LOW4
Vulnerabilities
Page 3 of 4
CVE-2020-4572P4MEDIUMCVSS 5.3v3.0.1v4.02020-07-29
CVE-2020-4572 [MEDIUM] CWE-209 CVE-2020-4572: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive inf
IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184179.
nvd
CVE-2019-4564P4MEDIUMCVSS 6.1≥ 2.6.0, ≤ 2.6.0.5≥ 2.7.0, ≤ 2.7.0.4+6 more2019-10-04
CVE-2019-4564 [MEDIUM] CWE-79 CVE-2019-4564: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. T
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
nvd
CVE-2021-38981P4MEDIUMCVSS 5.3≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+11 more2021-11-15
CVE-2021-38981 [MEDIUM] CWE-209 CVE-2021-38981: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain se
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212788.
nvd
CVE-2019-4514P4MEDIUMCVSS 5.3≥ 2.6.0, ≤ 2.6.0.5≥ 2.7.0, ≤ 2.7.0.4+6 more2019-10-04
CVE-2019-4514 [MEDIUM] CWE-200 CVE-2019-4514: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unaut
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165136.
nvd
CVE-2021-38980P4MEDIUMCVSS 5.3≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+10 more2021-11-23
CVE-2021-38980 [MEDIUM] CWE-209 CVE-2021-38980: IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212786.
nvd
CVE-2020-4568P4MEDIUMCVSS 5.5v3.0v3.0.1+1 more2020-11-10
CVE-2020-4568 [MEDIUM] CWE-522 CVE-2020-4568: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157.
nvd
CVE-2019-4566P4MEDIUMCVSS 5.5≥ 3.0, ≤ 3.0.0.2≥ 3.0.1, ≤ 3.0.1.1+2 more2019-09-24
CVE-2019-4566 [MEDIUM] CWE-312 CVE-2019-4566: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text whic
IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627.
nvd
CVE-2021-38976P4MEDIUMCVSS 5.5≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+11 more2021-11-15
CVE-2021-38976 [MEDIUM] CWE-522 CVE-2021-38976: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear tex
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.
nvd
CVE-2023-25686P4MEDIUMCVSS 5.5v3.0v3.0.1+4 more2023-03-21
CVE-2023-25686 [MEDIUM] CWE-522 CVE-2023-25686: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.
nvd
CVE-2017-1673P4MEDIUMCVSS 6.1v2.5.0v2.5.0.0+18 more2018-01-04
CVE-2017-1673 [MEDIUM] CWE-79 CVE-2017-1673: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulne
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133640.
nvd
CVE-2016-6096P4MEDIUMCVSS 6.1v2.5.0.0v2.5.0.1+9 more2017-02-07
CVE-2016-6096 [MEDIUM] CWE-79 CVE-2016-6096: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vul
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
nvd
CVE-2016-6092P4MEDIUMCVSS 6.2v2.5.0.0v2.5.0.1+9 more2017-02-07
CVE-2016-6092 [MEDIUM] CWE-200 CVE-2016-6092: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
nvd
CVE-2018-1743P4MEDIUMCVSS 5.3≥ 2.6.0, ≤ 2.6.0.4≥ 2.7.0, ≤ 2.7.0.3+4 more2018-10-08
CVE-2018-1743 [MEDIUM] CWE-200 CVE-2018-1743: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized u
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 148422.
nvd
CVE-2016-6099P4MEDIUMCVSS 5.3v2.5.0v2.5.0.0+10 more2017-02-02
CVE-2016-6099 [MEDIUM] CWE-200 CVE-2016-6099: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users.
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system.
nvd
CVE-2021-38982P4MEDIUMCVSS 5.4≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+11 more2021-11-15
CVE-2021-38982 [MEDIUM] CWE-79 CVE-2021-38982: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. Thi
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.
nvd
CVE-2017-1668P4MEDIUMCVSS 6.1v2.5.0v2.5.0.1+17 more2018-01-09
CVE-2017-1668 [MEDIUM] CWE-601 CVE-2017-1668: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trust
nvd
CVE-2020-4845P4MEDIUMCVSS 5.4≥ 3.0.1, < 3.0.1.5≥ 4.0, < 4.0.0.2+2 more2020-12-17
CVE-2020-4845 [MEDIUM] CWE-79 CVE-2020-4845: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnera
IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190289.
nvd
CVE-2021-38985P4MEDIUMCVSS 4.3≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+10 more2021-11-12
CVE-2021-38985 [MEDIUM] CWE-20 CVE-2021-38985: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not va
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
nvd
CVE-2021-38972P4MEDIUMCVSS 4.3≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+10 more2021-11-12
CVE-2021-38972 [MEDIUM] CWE-20 CVE-2021-38972: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not va
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
nvd
CVE-2021-38977P4MEDIUMCVSS 4.3≥ 3.0, ≤ 3.0.0.4≥ 3.0.1, ≤ 3.0.1.5+11 more2021-11-15
CVE-2021-38977 [MEDIUM] CWE-311 CVE-2021-38977: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on autho
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain t
nvd