CVE-2018-1751

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 148512.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
IBM	Security Key Lifecycle Manager	3.0; 3.0.0.2

References

http://www.ibm.com/support/docview.wss?uid=ibm10791829Vendor Advisory
http://www.securityfocus.com/bid/106734Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148512VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10791829Vendor Advisory
http://www.securityfocus.com/bid/106734Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148512VDB Entry, Vendor Advisory

Timeline

Published: Jan 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17534.3IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, use CVE-2018-175329.8Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autolo CVE-2018-175336.1Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insuff CVE-2018-175346.8Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This al CVE-2018-175365.4An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is s CVE-2018-175375.4An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewe CVE-2018-175389.8Axon (formerly TASER International) Evidence Sync 3.15.89 is vulnerable to process injection. NOTE: the vendor's position is that this CVE i CVE-2018-175397.5The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a deni CVE-2018-175407.5The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.CVE-2018-175425.3SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of oth CVE-2018-17555.9IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being CVE-2018-175529.8SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.