CVE-2021-38972

The CVE-2021-38972 issue affects IBM Security Key Lifecycle Manager (TKLM) and IBM Security Guardium Key Lifecycle Manager. The root cause is improper or insufficient input validation in TKLM when handling input/data, as described in IBM’s advisory. Affected versions are TKLM/Guardium KLM 3.0 (up...

Security Bulletin: Hazardous Input Validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38972)

Summary Hazardous Input Validation in IBM Security Guardium Key Lifecycle Manager CVE-2021-38972 Vulnerability Details CVEID: CVE-2021-38972 DESCRIPTION: IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties th...

Security Bulletin: Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38973)

Summary Hazardous input validation in IBM Security Guardium Key Lifecycle Manager CVE-2021-38973. Vulnerability Details CVEID: CVE-2021-38973 DESCRIPTION: IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties...

Security Bulletin: Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38985)

Summary Hazardous input validation in IBM Security Guardium Key Lifecycle Manager CVE-2021-38985. Vulnerability Details CVEID: CVE-2021-38985 DESCRIPTION: IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38984)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38984. Vulnerability Details CVEID: CVE-2021-38984 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38979)

Summary Use of a one way hash without a salt in IBM Security Guardium Key Lifecycle Manager CVE-2021-38979. Vulnerability Details CVEID: CVE-2021-38979 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a passwor...

Security Bulletin: Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38983)

Summary Inadequate encryption strength in IBM Security Guardium Key Lifecycle Manager CVE-2021-38983. Vulnerability Details CVEID: CVE-2021-38983 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti...

Security Bulletin: Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38976)

Summary Password stored in cleartext in IBM Security Guardium Key Lifecycle Manager CVE-2021-38976. Vulnerability Details CVEID: CVE-2021-38976 DESCRIPTION: IBM Tivoli Key Lifecycle Manager stores user credentials in plain clear text which can be read by a local user. CVSS Base score: 6.2 CVSS...

Security Bulletin: Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager (CVE-2021-20492)

Summary Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager CVE-2021-20492. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE...

Security Bulletin: Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38977)

Summary Missing cookie secure attribute in IBM Security Guardium Key Lifecycle Manager CVE-2021-38977. Vulnerability Details CVEID: CVE-2021-38977 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to g...

Security Bulletin: Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38978)

Summary Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager CVE-2021-38978. Vulnerability Details CVEID: CVE-2021-38978 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38981)

Summary Application error in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38981. Vulnerability Details CVEID: CVE-2021-38981 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne...

Security Bulletin: Denial of service in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38974)

Summary Denial of service in IBM Security Guardium Key Lifecycle Manager CVE-2021-38974. Vulnerability Details CVEID: CVE-2021-38974 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. CVSS Base score:...

Security Bulletin: Information exposure in IBM Security Guardium Key Lifecycle Manager 4.1.1 (CVE-2021-38975)

Summary Information exposure in IBM Security Guardium Key Lifecycle Manager 4.1.1 CVE-2021-38975. Vulnerability Details CVEID: CVE-2021-38975 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request...

Security Bulletin: Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38982)

Summary Cross-Site scripting in IBM Security Guardium Key Lifecycle Manager CVE-2021-38982. Vulnerability Details CVEID: CVE-2021-38982 DESCRIPTION: IBM Tivoli Key Lifecycle Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

IBM Tivoli Key Lifecycle Manager 加密问题漏洞

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IBM Tivoli Key Lifecycle Manager that stems fr...

IBM Tivoli Key Lifecycle Manager 信息泄露漏洞

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance, and key lifecycle management for storage devices.A security vulnerability exists in IBM Tivoli Key Lifecycle Manager. An attacker...

CVE-2021-38976

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781...

IBM Tivoli Key Lifecycle Manager 安全漏洞

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM Corporation. The software provides key storage, key maintenance, and key lifecycle management for storage devices.A security vulnerability exists in IBM Tivoli Key Lifecycle Manager, which stems from the...

IBM Tivoli Key Lifecycle Manager 输入验证错误漏洞

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM Corporation. The software provides key storage, key maintenance, and key lifecycle management for storage devices.A security vulnerability exists in IBM Tivoli Key Lifecycle Manager, which stems from the...