Security Bulletin: Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38973)

Summary Hazardous input validation in IBM Security Guardium Key Lifecycle Manager CVE-2021-38973. Vulnerability Details CVEID: CVE-2021-38973 DESCRIPTION: IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties...

Security Bulletin: Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38985)

Summary Hazardous input validation in IBM Security Guardium Key Lifecycle Manager CVE-2021-38985. Vulnerability Details CVEID: CVE-2021-38985 DESCRIPTION: IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38984)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38984. Vulnerability Details CVEID: CVE-2021-38984 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38979)

Summary Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager CVE-2021-38979. Vulnerability Details CVEID: CVE-2021-38979 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a passwor...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38983)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38983. Vulnerability Details CVEID: CVE-2021-38983 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38976)

Summary Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager CVE-2021-38976. Vulnerability Details CVEID: CVE-2021-38976 DESCRIPTION: IBM Tivoli Key Lifecycle Manager stores user credentials in plain clear text which can be read by a local user. CVSS Base score: 6.2 CVSS...

Security Bulletin: Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager (CVE-2021-20492)

Summary Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager CVE-2021-20492. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE...

Security Bulletin: Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38977)

Summary Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager CVE-2021-38977. Vulnerability Details CVEID: CVE-2021-38977 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to g...

Security Bulletin: Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38978)

Summary Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager CVE-2021-38978. Vulnerability Details CVEID: CVE-2021-38978 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38981)

Summary Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38981. Vulnerability Details CVEID: CVE-2021-38981 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne...

Security Bulletin: Denial of service in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38974)

Summary Denial of service in IBM Security Guardium Key Lifecycle Manager CVE-2021-38974. Vulnerability Details CVEID: CVE-2021-38974 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. CVSS Base score:...

Security Bulletin: Information exposure in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38975)

Summary Information exposure in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38975. Vulnerability Details CVEID: CVE-2021-38975 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request...

Security Bulletin: Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38982)

Summary Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager CVE-2021-38982. Vulnerability Details CVEID: CVE-2021-38982 DESCRIPTION: IBM Tivoli Key Lifecycle Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

CVE-2021-29735

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2021-29735

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross site scripting

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2021-29735

CVE-2021-29735 affects IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3. The vulnerability is a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted session. The ro...

CVE-2021-29735

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2021-29735: Improper Neutralization of Input During Web Page Generation

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2021-18437

Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 10.5 through 11.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...