IBM Security Key Lifecycle Manager vulnerabilities

70 CVEs affecting IBM Security Key Lifecycle Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25924, published 2023-03-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1745, published 2018-10-11. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. IBM X-Force ID: 148424.
CVE-2017-1671, published 2018-01-09. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"…
CVE-2016-6104, published 2017-02-07. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute…
CVE-2018-1744, published 2018-10-15. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot…
CVE-2020-4567, published 2020-07-29. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156.
CVE-2016-6105, published 2017-02-01. High severity, CVSS 8.2. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas.
CVE-2020-4574, published 2020-07-29. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181.
CVE-2017-1670, published 2018-01-09. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify…
CVE-2018-1747, published 2018-10-15. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…
CVE-2016-6093, published 2017-06-08. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

Latest

CVE-2023-25924, published 2023-03-22. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. …
CVE-2023-25688, published 2023-03-22. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request…
CVE-2023-25684, published 2023-03-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the…
CVE-2023-25923, published 2023-03-21. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. …
CVE-2023-25686, published 2023-03-21. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.
CVE-2023-25689, published 2023-03-21. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL…
CVE-2023-25687, published 2023-03-21. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.
CVE-2021-38980, published 2021-11-23. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error…
CVE-2021-38984, published 2021-11-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:…
CVE-2021-38983, published 2021-11-15. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:…