CVE-2014-6163

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-3058

The CVE-2014-3058 vulnerability affects IBM WebSphere DataPower XC10 appliance versions 2.1 and 2.5 prior to FP4. It is a CSRF flaw that enables remote authenticated users to hijack the authentication of arbitrary users via requests that insert XSS sequences. Exploitation details are not provided...

Code injection

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2013-5446

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

Design/Logic Flaw

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

CVE-2013-5428

CVE-2013-5428 affects IBM WebSphere DataPower XC10 appliances (notably 2.5.0; also referenced for 2.1) where unauthenticated access to administrative actions can trigger a denial of service. Exploitation details are not provided in the documents. Vendor patches exist via IBM Fix Central and speci...

CVE-2013-5403

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors...

Code injection

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

CVE-2012-5756

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

CVE-2012-5758

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authentication for an unspecified interface, which allows remote attackers to cause a denial of service process exit via unknown vectors...