Security Bulletin: Sensitive data lingers in memory on the WebSphere DataPower XC10 Appliance

Summary Sensitive data lingers in memory allowing access by an administrator of the WebSphere DataPower XC10 Appliance. This is addressed in the interim fix. Vulnerability Details CVEID: CVE-2015-7418 DESCRIPTION: The IBM WebSphere DataPower XC10 Appliance allows some sensitive data to linger in...

Security Bulletin: Vulnerability in Apache Commons affects WebSphere DataPower XC10 Appliance (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the syste...

Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance

Summary There are multiple vulnerabilities in IBM Java Runtime Version 7 that is used by WebSphere DataPower XC10 Appliance Versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerability in RC4 stream cipher affects WebSphere DataPower XC10 Appliance V2.1 (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects WebSphere DataPower XC10 Appliance Version 2.1. WebSphere DataPower XC10 Appliance Version 2.5 is not affected. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere DataPower XC10 Appliance: CVE-2015-0138, CVE-2014-6593, CVE-2015-0410

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition. These vulnerabilities affect WebSphere DataPower XC10 versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK:...

Security Bulletin: GNU C library (glibc) vulnerability affects WebSphere DataPower XC10 Appliance (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID:CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafte...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere DataPower XC10 Appliance versions 2.1 and 2.5 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in the WebSphere DataPower XC10 Appliance versions 2.1 and 2.5. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: The product could allow a...

Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance

Summary Three security vulnerabilities were identified in the IBM® SDK, Java™ Technology Edition provided with WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID: CVE-2014-0878 DESCRIPTION: A vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom...

Security Bulletin: WebSphere eXtreme Scale and WebSphere DataPower XC10 Appliance client vulnerability (CVE-2013-6734)

Summary In certain configurations, a security vulnerability exists in WebSphere eXtreme Scale Client, the client that is used with WebSphere eXtreme Scale and WebSphere DataPower XC10 Appliance. WebSphere eXtreme Scale Client might allow cached HTTP session data of one user to be accessed by a...

Information disclosure

IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user with administrator privileges to obtain sensitive information...

IBM Websphere DataPower XC10 Denial of Service Vulnerability

IBM Websphere datapower XC10 is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-2870

Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors...

CVE-2016-2870

CVE-2016-2870 affects IBM WebSphere DataPower XC10 Appliances, specifically versions 2.1 and 2.5. The vulnerability is a buffer overflow in the CLI that can lead to a denial of service, impacting system availability. The issue is documented with a CVSS base score of 2.7 (3.0 vector: CVSS:3.0/AV:N...

CVE-2016-2870

Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors...

IBM WebSphere DataPower XC10 Buffer Overflow Vulnerability

IBM WebSphere DataPower XC10 is a caching platform from IBM in the United States. The platform allows distributed caching of data with little or no change to existing applications. A buffer overflow vulnerability exists in the CLI of IBM WebSphere DataPower XC10 version 2.1 and 2.5. An attacker...

CVE-2015-1970

The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere...

CVE-2015-1893

The CVE-2015-1893 entry applies to IBM WebSphere DataPower XC10 Appliance Version 2.1. The vulnerability allows remote attackers to hijack a valid user’s session, leading to potential disclosure of sensitive information or data modification due to improper validation. The IBM Security Bulletin fo...

CVE-2014-6163

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-3058

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...