CVE-2016-6095
CriticalSummary
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
Risk Assessment
The organization may be exposed to unauthorized access to user accounts, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to configure appropriate account lockout settings and monitor login attempts to minimize the risk of brute force attacks.
Other vulnerabilities in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6
See all- CVE-2016-6103High
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
- CVE-2016-6105High
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 do not perform an authentication check for critical resources or functionalities, allowing anonymous users access to protected areas.
Original NVD description (English source)
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.