CVE-2017-1669

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 133636...

CVE-2017-1672

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639...

CVE-2017-1727

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the system. IBM X-Force ID: 134869...

CVE-2017-1669

IBM Tivoli Key Lifecycle Manager (SKLM) versions 2.5–2.7 store sensitive information in URL parameters, enabling potential information disclosure if URLs are captured in server logs, referer headers, or browser history. Underlying cause is storing sensitive data in URL parameters. Affected versio...

CVE-2017-1672

CVE-2017-1672 affects IBM Security Key Lifecycle Manager (Tivoli) 2.6 (2.6.0.3 fix) and 2.7 (2.7.0.2 fix), with CSRF permitting unauthorized actions from trusted users. Root cause: cross-site request forgery in the web interface. CVSSv3 base score 8.8 (HIGH) per NVD, vector CVSS:3.0/AV:N/AC:L/PR:...

CVE-2017-1727

IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager) versions 2.5, 2.6, and 2.7 disclose sensitive information in error messages, potentially aiding attackers in targeted follow-up actions. The CVE-2017-1727 entry is documented with a CVSS v3 base score of 4.3 (vector: CVSS:...

CVE-2017-1673

CVE-2017-1673 affects IBM Security Key Lifecycle Manager (Tivoli KLM) versions 2.5–2.7, with a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. IBM security bulletins corroborate XSS in SKLM and provide remediations: upgrade to 2.6...

CVE-2017-1673

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2017-1665

The CVE-2017-1665 issue affects IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager), specifically versions 2.5, 2.6, and 2.7, where weaker than expected cryptographic algorithms could allow decryption of sensitive information. IBM’s bulletin confirms the affected ranges and...

PT-2018-6316

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

CVE-2017-1669: Exposure of Sensitive Information to an Unauthorized Actor

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 133636...

CVE-2017-1665: Inadequate Encryption Strength

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133559...

CVE-2017-1672: Cross-Site Request Forgery (CSRF)

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639...

CVE-2017-1727: Insertion of Sensitive Information into Log File

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the system. IBM X-Force ID: 134869...

PT-2018-6299

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: F...

PT-2018-6300

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: F...

PT-2018-6305

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue allows for potential information disclosure due to sensitive information being stored in URL parameters. If unauthorized parties gain access to the URLs through...

PT-2018-6312

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.6 through 2.7 Description: The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting malicious actions...

PT-2018-6462

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Key Lifecycle Manager versions 2.5 through 2.7 Description: The issue discloses sensitive information in error messages, which could aid an attacker in further attacks against the system. Recommendations: For versions 2.5 through...

CVE-2017-1664: Inadequate Encryption Strength

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133557...