IBM Tivoli Key Lifecycle Manager vulnerabilities

6 CVEs affecting IBM Tivoli Key Lifecycle Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-6098, published 2017-06-08.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-6093, published 2017-06-08. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
• CVE-2016-6098, published 2017-06-08. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CVE-2016-6094, published 2017-02-07. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data.
• CVE-2016-6096, published 2017-02-07. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
• CVE-2016-6097, published 2017-02-07. Medium severity, CVSS 4.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system.
• CVE-2016-6092, published 2017-02-07. Medium severity, CVSS 6.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.