IBM Security Guardium Key Lifecycle Manager 4.2.0

CPE Details

IBM Security Guardium Key Lifecycle Manager 4.2.0
ibm
security_guardium_key_lifecycle_manager
4.2.0
2023-12-29
09h10 +00:00
2023-12-29
09h10 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.0:*:*:*:*:*:*:*

Informations

Vendor

ibm

Product

security_guardium_key_lifecycle_manager

Version

4.2.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-49816 2024-12-17 17h42 +00:00 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.
4.9
Medium
CVE-2024-49820 2024-12-17 17h42 +00:00 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
3.7
Low
CVE-2024-49819 2024-12-17 17h41 +00:00 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
7.5
High
CVE-2024-49818 2024-12-17 17h35 +00:00 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
4.3
Medium
CVE-2024-49817 2024-12-17 17h34 +00:00 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.
4.4
Medium
CVE-2023-47707 2023-12-20 01h48 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271522.
5.4
Medium
CVE-2023-47703 2023-12-20 01h45 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197.
5.3
Medium
CVE-2023-47702 2023-12-20 01h11 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system. IBM X-Force ID: 271196.
9.1
Critical
CVE-2023-47706 2023-12-20 00h59 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341.
8.8
High
CVE-2023-47705 2023-12-20 00h56 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228.
4.3
Medium
CVE-2023-47704 2023-12-20 00h50 +00:00 IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220.
7.5
High