Security Guardium Key Lifecycle Manager vulnerabilities
7 known vulnerabilities in Security Guardium Key Lifecycle Manager from IBM. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Security Guardium Key Lifecycle Manager: Cleartext Transmission of Sensitive Information
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 8.2 High severity
Security Guardium Key Lifecycle Manager: Improper Restriction of XML External Entity Reference
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume m
- 8.8 High severity
Security Guardium Key Lifecycle Manager: Unrestricted Upload of File with Dangerous Type
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.
- 8.8 High severity
Security Guardium Key Lifecycle Manager: Improper Neutralization of Special Elements used in an OS Command
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632.
- 8.8 High severity
Security Guardium Key Lifecycle Manager: Unrestricted Upload of File with Dangerous Type
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621.
- 9.1 Critical severity
Security Guardium Key Lifecycle Manager: Improper Limitation of a Pathname to a Restricted Directory
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system. IBM X-Force ID
- 7.5 High severity
Security Guardium Key Lifecycle Manager: Use of Hard-coded Credentials
IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220.