IBM Security Key Lifecycle Manager

• CVE-2023-25684 Medium 6.5 IBM Security Key Lifecycle Manager SQL injection 1.0%
• CVE-2023-25686 Medium 6.2 IBM Security Key Lifecycle Manager information disclosure 0.2%
• CVE-2023-25923 Low 2.7 IBM Security Key Lifecycle Manager denial of service 0.7%
• CVE-2023-25688 Medium 4.3 IBM Security Key Lifecycle Manager information disclosure 0.9%
• CVE-2023-25687 Medium 4.3 IBM Security Key Lifecycle Manager information disclosure 0.5%
• CVE-2023-25924 Medium 5.4 IBM Security Key Lifecycle Manager improper authorization 0.4%
• CVE-2023-25689 Low 2.7 IBM Security Key Lifecycle Manager information disclosure 0.7%
• CVE-2021-38980 Low 2.7 IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error me 1.2%
• CVE-2021-38984 Low 3.7 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 21279 0.6%
• CVE-2021-38983 Medium 4.4 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 21279 0.9%
• CVE-2021-38982 Medium 5.4 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inte 0.5%
• CVE-2021-38981 Medium 5.3 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa 1.4%
• CVE-2021-38979 Medium 4.4 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a sal 0.7%
• CVE-2021-38978 Medium 5.9 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An att 0.9%
• CVE-2021-38977 Low 3.1 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http 0.5%
• CVE-2021-38976 Medium 6.2 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781. 0.2%
• CVE-2021-38975 Medium 4.3 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 212780. 1.0%
• CVE-2021-38974 Medium 5.4 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779. 1.0%
• CVE-2021-38985 Medium 4.3 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the d 0.6%
• CVE-2021-38973 Low 2.4 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the d 0.6%
• CVE-2021-38972 Medium 4.3 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the d 0.6%
• CVE-2020-4846 Low 2.7 IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information coul 1.0%
• CVE-2020-4845 Medium 5.4 IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func 0.6%
• CVE-2020-4568 Medium 6.3 IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157. 0.7%
• CVE-2020-4574 High 7.4 IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181. 1.9%
• CVE-2020-4573 Medium 5.3 IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180. 1.3%
• CVE-2020-4572 Medium 5.3 IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could 1.7%
• CVE-2020-4569 Medium 6.5 IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasse 1.2%
• CVE-2020-4567 High 8.6 IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156. 2.3%