SG
Product
Security Guardium Key Lifecycle Manager
29
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 16Low 2
Watch
Add Security Guardium Key Lifecycle Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-47702 | 9.1 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system Affected: 4.2.0 before 4.2.0.2 |
| CVE-2023-25921 | 8.8 | Feb 29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed… Affected: 3.0.0 before 4.1.1.7 |
| CVE-2023-25925 | 8.8 | Feb 28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a… Affected: 3.0.0 before 4.1.1.7 |
| CVE-2023-25922 | 8.8 | Feb 28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed… Affected: 3.0.0 before 4.1.1.7 |
| CVE-2023-47706 | 8.8 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type Affected: 4.2.0 before 4.2.0.2 |
| CVE-2023-25926 | 8.2 | Feb 29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 3.0.0 before 4.1.1.7 |
| CVE-2024-49819 | 7.5 | Dec 17 | IBM Security Guardium Key Lifecycle Manager information disclosure Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 |
| CVE-2023-47704 | 7.5 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository Affected: 4.2.0 before 4.2.0.2 |
| CVE-2021-38984 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 4.1.0 through 4.1.0.1; 4.1.1 |
| CVE-2021-38983 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38979 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software… Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38975 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38974 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38978 | 5.9 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict… Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38976 | 5.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2023-47707 | 5.4 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting Affected: 4.2.0 through 4.2.0.2 |
| CVE-2021-38982 | 5.4 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2023-47703 | 5.3 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 4.2.0 before 4.2.0.2 |
| CVE-2021-38980 | 5.3 | Nov 23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a… Affected: 4.1.0 through 4.1.0.1; 4.1.1 |
| CVE-2021-38981 | 5.3 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2024-49816 | 4.4 | Dec 17 | IBM Security Guardium Key Lifecycle Manager information disclosure Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 |
| CVE-2024-49817 | 4.4 | Dec 17 | IBM Security Guardium Key Lifecycle Manager information disclosure Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 |
| CVE-2024-49818 | 4.3 | Dec 17 | IBM Security Guardium Key Lifecycle Manager information disclosure Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 |
| CVE-2023-47705 | 4.3 | Dec 20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation Affected: 4.2.0 before 4.2.0.2 |
| CVE-2021-38977 | 4.3 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies Affected: 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38985 | 4.3 | Nov 12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are… Affected: 4.1.0 through 4.1.0.1; 4.1.1 |
| CVE-2021-38972 | 4.3 | Nov 12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are… Affected: 4.1.0 through 4.1.0.1; 4.1.1 |
| CVE-2024-49820 | 3.7 | Dec 17 | IBM Security Guardium Key Lifecycle Manager information disclosure Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 |
| CVE-2021-38973 | 2.7 | Nov 12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are… Affected: 4.1.0 through 4.1.0.1; 4.1.1 |
Showing 29