CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1742
https://notcve.org/view.php?id=CVE-2018-1742
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 148421. IBM Tivoli Key Lifecycle Manager 2.6, 2.7 y 3.0 contiene credenciales embebidas, como una contraseña o clave criptográfica, que emplea para su propia autenticación entrante, comunicaciones a componentes externos o cifrado de datos internos. IBM X-Force ID: 148421. • http://www.ibm.com/support/docview.wss?uid=ibm10733419 https://exchange.xforce.ibmcloud.com/vulnerabilities/148421 • CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1753
https://notcve.org/view.php?id=CVE-2018-1753
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 148514. IBM Tivoli Key Lifecycle Manager 2.6, 2.7 y 3.0 genera un mensaje de error que incluye información sensible sobre su entorno, usuarios o datos asociados. IBM X-Force ID: 148514. • http://www.ibm.com/support/docview.wss?uid=ibm10733359 https://exchange.xforce.ibmcloud.com/vulnerabilities/148514 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2017-1668
https://notcve.org/view.php?id=CVE-2017-1668
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 133562. IBM Tivoli Key Lifecycle Manager 2.5, 2.6 y 2.7 podría permitir que un atacante remoto lleve a cabo ataques de phishing empleando un ataque de redirección abierta. • http://www.ibm.com/support/docview.wss?uid=swg22012010 http://www.securityfocus.com/bid/102430 https://exchange.xforce.ibmcloud.com/vulnerabilities/133562 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2017-1670
https://notcve.org/view.php?id=CVE-2017-1670
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637. IBM Tivoli Key Lifecycle Manager 2.5, 2.6, y 2.7 es vulnerable a una inyección SQL. Un atacante remoto podría enviar instrucciones SQL especialmente manipuladas que podrían permitir que el atacante viese, añadiese, modificase o borrase información en la base de datos del backend. • http://www.ibm.com/support/docview.wss?uid=swg22012009 http://www.securityfocus.com/bid/102429 https://exchange.xforce.ibmcloud.com/vulnerabilities/133637 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2017-1671
https://notcve.org/view.php?id=CVE-2017-1671
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 133638. IBM Tivoli Key Lifecycle Manager 2.5, 2.6 y 2.7 podría permitir que un atacante remoto salte directorios en el sistema. Un atacante podría enviar una petición URL especialmente manipulada que contenga secuencias "punto punto" (/../) para visualizar archivos arbitrarios en el sistema. • http://www.ibm.com/support/docview.wss?uid=swg22011967 http://www.securityfocus.com/bid/102487 https://exchange.xforce.ibmcloud.com/vulnerabilities/133638 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •