SK
Product
Security Key Lifecycle Manager
70
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 41Low 4
Watch
Add Security Key Lifecycle Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-25684 | 9.8 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2020-4567 | 9.8 | Jul 29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials Affected: 3.0.1; 4.0 |
| CVE-2017-1670 | 9.8 | Jan 9 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection Affected: 2.5.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2016-6093 | 9.8 | Jun 8 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2016-6095 | 9.8 | Feb 2 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2018-1742 | 9.3 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2023-25924 | 8.8 | Mar 22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to… Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2017-1672 | 8.8 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 2.6.0; 2.6.0.1; 2.6.0.2; 2.6.0.3; 2.7.0; 2.7.0.1; +1 more |
| CVE-2016-6103 | 8.8 | Feb 2 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2016-6105 | 8.2 | Feb 1 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2018-1750 | 8.1 | Oct 8 | IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors Affected: 2.6.0 through 2.6.0.5; 2.7.0 through 2.7.0.4; 3.0; 3.0.0.1 |
| CVE-2017-1666 | 8.1 | Jan 9 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 2.5.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2016-6098 | 8.1 | Jun 8 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended… Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2023-25923 | 7.5 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to… Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38984 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3 |
| CVE-2021-38983 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38979 | 7.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4574 | 7.5 | Jul 29 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 3.0.1; 4.0 |
| CVE-2019-4565 | 7.5 | Sep 20 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… Affected: 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2018-1751 | 7.5 | Jan 23 | IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 3.0; 3.0.0.2 |
| CVE-2018-1745 | 7.5 | Oct 11 | IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication Affected: 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2017-1671 | 7.5 | Jan 9 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system Affected: 2.5.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2016-6104 | 7.2 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the… Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2018-1747 | 7.1 | Oct 15 | IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 2.5.0 through 2.5.0.9; 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0.0 through 3.0.0.1 |
| CVE-2018-1738 | 7.1 | Oct 11 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0.0 through 3.0.0.1 |
| CVE-2021-38975 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38974 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4569 | 6.5 | Jul 29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor… Affected: 3.0.1; 4.0 |
| CVE-2019-4515 | 6.5 | Sep 24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 3.0.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2018-1744 | 6.5 | Oct 15 | IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system Affected: 2.5.0 through 2.5.0.9; 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0.0 through 3.0.0.1 |
| CVE-2018-1749 | 6.5 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2018-1741 | 6.5 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2016-6092 | 6.2 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2019-4564 | 6.1 | Oct 4 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting Affected: 2.6.0 through 2.6.0.5; 2.7.0 through 2.7.0.4; 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2017-1668 | 6.1 | Jan 9 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack Affected: 2.5.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2017-1673 | 6.1 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2016-6096 | 6.1 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2021-38978 | 5.9 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2017-1665 | 5.9 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2017-1664 | 5.9 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2016-6116 | 5.9 | Feb 2 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2023-25686 | 5.5 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38976 | 5.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4568 | 5.5 | Nov 10 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user Affected: 3.0; 3.0.1; 4.0 |
| CVE-2019-4566 | 5.5 | Sep 24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user Affected: 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2021-38982 | 5.4 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4845 | 5.4 | Dec 17 | IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting Affected: 3.0.1 before 3.0.1.5; 4.0 before 4.0.0.2 |
| CVE-2023-25688 | 5.3 | Mar 22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2023-25689 | 5.3 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38980 | 5.3 | Nov 23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3 |