CVE-2016-6093

CRITICAL

IBM Tivoli Key Lifecycle Manager - Info Disclosure

Title source: llm
STIX 2.1

Description

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21997956
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95985
VDB Entry, Vendor Advisory x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/118172

Scores

CVSS v3 9.8
EPSS 0.0175
EPSS Percentile 75.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-255
Status published
Products (23)
IBM/Security Key Lifecycle Manager 2.0.1
IBM/Security Key Lifecycle Manager 2.5
IBM/Security Key Lifecycle Manager 2.6
ibm/security_key_lifecycle_manager 2.5.0.0
ibm/security_key_lifecycle_manager 2.5.0.1
ibm/security_key_lifecycle_manager 2.5.0.2
ibm/security_key_lifecycle_manager 2.5.0.3
ibm/security_key_lifecycle_manager 2.5.0.4
ibm/security_key_lifecycle_manager 2.5.0.5
ibm/security_key_lifecycle_manager 2.5.0.6
... and 13 more
Published Jun 08, 2017
Tracked Since Feb 18, 2026