CVE-2018-1742: Use of Hard-coded Credentials

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 148421...

Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742)

Summary IBMSecurity Key Lifecycle Manager contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Vulnerability Details CVEID: CVE-2018-1742...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Hazardous Input Validation ( CVE-2018-1749)

Summary IBM Security Key Lifecycle Manager uses incomplete blocklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. Vulnerability Details CVEID: CVE-2018-1749 DESCRIPTION: IBM Tivoli Key Lifecycle Manager...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Information Exposure (CVE-2018-1743)

Summary IBM Security Key Lifecycle Manager discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. Vulnerability Details CVEID: CVE-2018-1743 DESCRIPTION: IBM Tivoli Key Lifecycle Manager discloses sensitive information to...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Authentication (CVE-2018-1738)

Summary IBM Security Key Lifecycle Manager could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper authentication mechanisms. Vulnerability Details CVEID: CVE-2018-1738 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an...

Security Bulletin: IBM Security Key Lifecycle Manager generates Application Error (CVE-2018-1753)

Summary IBM Security Key Lifecycle Manager generates an error message that includes sensitive information about its environment, users, or associated data. Vulnerability Details CVEID: CVE-2018-1753 DESCRIPTION: IBM Tivoli Key Lifecycle Manager generates an error message that includes sensitive...

Security Bulletin: IBM Security Key Lifecycle Manager Misses Authentication for Critical Function (CVE-2018-1745)

Summary IBM Security Key Lifecycle Manager could allow an unauthenticated user to restart the SKLM server due to missing authentication. Vulnerability Details CVEID: CVE-2018-1745 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an unauthenticated user to restart the SKLM server due to...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Path Traversal (CVE-2018-1744)

Summary IBM Security Key Lifecycle Manager could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2018-1744 DESCRIPTION:...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection (XXE) attack (CVE-2018-1747)

Summary IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2018-1747 DESCRIPTION:...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Control of Interaction Frequency (CVE-2018-1741)

Summary IBM Security Key Lifecycle Manager does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. Vulnerability Details CVEID: CVE-2018-1741 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Agile Lifecycle Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 Service Refresh 5 Fix Pack 15 and earlier releases used by IBM Agile Lifecycle Manager. Agile Lifecycle Manager has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the I...

IBM Rational Engineering Lifecycle Manager XML External Entity Injection Vulnerability

IBM Rational Engineering Lifecycle Manager visualizes, analyzes, and organizes engineering lifecycle data and data relationships. An XML external entity injection vulnerability exists in IBM Rational Engineering Lifecycle Manager. A remote attacker could exploit this vulnerability to obtain...

IBM Rational Engineering Lifecycle Manager Certification Bypass Vulnerability

IBM Rational Engineering Lifecycle Manager visualizes, analyzes, and organizes engineering lifecycle data and data relationships. An authentication bypass vulnerability exists in IBM Rational Engineering Lifecycle Manager. A remote attacker could exploit this vulnerability to bypass authenticatio...

IBM Rational Engineering Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2018-20088)

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A cross-site scripting vulnerability exists in IBM Rational Engineering Lifecycle Manager versions 5.0 through 5.02 and 6.0 through 6.0.6. A remote attacker can exploi...

CVE-2018-1539

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561...

CVE-2018-1659

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2018-1539

CVE-2018-1539 affects IBM Rational Engineering Lifecycle Manager versions 5.0–5.02 and 6.0–6.0.6. The issue allows remote attackers to bypass authentication via a direct request or forced browsing to a URL outside the intended page. Public details in connected IBM advisories describe this as an a...

CVE-2018-1560

IBM Rational Engineering Lifecycle Manager is affected by CVE-2018-1560: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 5.0–5.02 and 6.0–6.0.6. Remediation per IBM bulletin: upgrade to 6.0.6 IFIX02 or late...

CVE-2018-1607

CVE-2018-1607 affects IBM Rational Engineering Lifecycle Manager 5.0–5.02 and 6.0–6.0.6. It enables a XML External Entity (XXE) attack when parsing XML, potentially exposing sensitive information or consuming memory resources. The security bulletin lists multiple affected versions and states reme...

CVE-2018-1560

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...