CVE-2021-38979

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785...

CVE-2021-38978

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2021-38978

IBM Tivoli Key Lifecycle Manager (TKLM) and related IBM Security Guardium Key Lifecycle Manager versions (3.0–4.1) are affected by CVE-2021-38978 due to failure to properly enable HTTP Strict Transport Security. This allows a remote attacker to potentially obtain sensitive information via MITM. A...

CVE-2021-38977

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent t...

CVE-2021-38977

Summary: CVE-2021-38977 affects IBM Tivoli Key Lifecycle Manager (TKLM) versions 3.0–4.1. The vulnerability arises because authorization tokens and session cookies are not marked with the Secure attribute, enabling an attacker to capture cookie values by persuading a user to visit an http (non-HT...

CVE-2021-38976

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781...

CVE-2021-38975

CVE-2021-38975 describes an information-exposure vulnerability in IBM Security Key Lifecycle Manager / Tivoli Key Lifecycle Manager. The IBM Security Guardium Key Lifecycle Manager product line (TKLM) versions 3.0–4.0.x and 4.1.x allow an authenticated user to obtain sensitive information via a s...

CVE-2021-38974

IBM Tivoli Key Lifecycle Manager (TKLM) and IBM Security Guardium Key Lifecycle Manager are affected by CVE-2021-38974. An authenticated user can cause a denial of service by sending specially crafted HTTP requests, due to improper handling of certain requests (network access, low attack complexi...

CVE-2021-38974

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779...

PT-2021-22344

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle...

PT-2021-22345

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but it does not also use a salt as part of the input...

CVE-2021-38983: Inadequate Encryption Strength

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 212792...

PT-2021-22340

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue allows an authenticated user to cause a denial of service using specially crafted HTTP requests. Recommendations For versions 3.0 through 4.1, consider restricting...

PT-2021-22348

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2021-22350

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For...

CVE-2021-38974: Undefined Security Weakness

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779...

CVE-2021-38979: Use of Password Hash With Insufficient Computational Effort

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785...

CVE-2021-38978: Cleartext Transmission of Sensitive Information

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2021-38981: Generation of Error Message Containing Sensitive Information

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212788...

CVE-2021-38982: Improper Neutralization of Input During Web Page Generation

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...