SK
Product
Security Key Lifecycle Manager
70
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 41Low 4
Watch
Add Security Key Lifecycle Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-38975 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38974 | 6.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4569 | 6.5 | Jul 29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor… Affected: 3.0.1; 4.0 |
| CVE-2019-4515 | 6.5 | Sep 24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 3.0.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2018-1744 | 6.5 | Oct 15 | IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system Affected: 2.5.0 through 2.5.0.9; 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0.0 through 3.0.0.1 |
| CVE-2018-1749 | 6.5 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2018-1741 | 6.5 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise… Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2016-6092 | 6.2 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2019-4564 | 6.1 | Oct 4 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting Affected: 2.6.0 through 2.6.0.5; 2.7.0 through 2.7.0.4; 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2017-1668 | 6.1 | Jan 9 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack Affected: 2.5.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2017-1673 | 6.1 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2016-6096 | 6.1 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2021-38978 | 5.9 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2017-1665 | 5.9 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2017-1664 | 5.9 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +11 more |
| CVE-2016-6116 | 5.9 | Feb 2 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2023-25686 | 5.5 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38976 | 5.5 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4568 | 5.5 | Nov 10 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user Affected: 3.0; 3.0.1; 4.0 |
| CVE-2019-4566 | 5.5 | Sep 24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user Affected: 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2021-38982 | 5.4 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4845 | 5.4 | Dec 17 | IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting Affected: 3.0.1 before 3.0.1.5; 4.0 before 4.0.0.2 |
| CVE-2023-25688 | 5.3 | Mar 22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2023-25689 | 5.3 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38980 | 5.3 | Nov 23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3 |
| CVE-2021-38981 | 5.3 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2020-4573 | 5.3 | Jul 29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests Affected: 3.0.1; 4.0 |
| CVE-2020-4572 | 5.3 | Jul 29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 3.0.1; 4.0 |
| CVE-2019-4514 | 5.3 | Oct 4 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users Affected: 2.6.0 through 2.6.0.5; 2.7.0 through 2.7.0.4; 3.0 through 3.0.0.2; 3.0.1 through 3.0.1.1 |
| CVE-2018-1743 | 5.3 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2016-6099 | 5.3 | Feb 2 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2016-6117 | 5.3 | Feb 1 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information Affected: 2.5.0; 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; +6 more |
| CVE-2023-25687 | 4.3 | Mar 21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files Affected: 3.0; 3.0.1; 4.0; 4.1; 4.1.1 |
| CVE-2021-38977 | 4.3 | Nov 15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3; 4.1.0; 4.1.0.1; 4.1.1 |
| CVE-2021-38985 | 4.3 | Nov 12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3 |
| CVE-2021-38972 | 4.3 | Nov 12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are… Affected: 3.0 through 3.0.0.4; 3.0.1 through 3.0.1.5; 4.0 through 4.0.0.3 |
| CVE-2018-1753 | 4.3 | Oct 8 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data Affected: 2.6.0 through 2.6.0.4; 2.7.0 through 2.7.0.3; 3.0 through 3.0.0.1 |
| CVE-2017-1727 | 4.3 | Jan 4 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the system Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +10 more |
| CVE-2016-6094 | 4.3 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
| CVE-2014-0872 | 4.1 | Apr 25 | The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive information by leveraging root… Affected: 2.5.0 |
| CVE-2016-6097 | 4.0 | Feb 7 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system Affected: 2.5.0.0; 2.5.0.1; 2.5.0.2; 2.5.0.3; 2.5.0.4; 2.5.0.5; +5 more |
Showing 41