CVE-2022-31776

CVE-2022-31776 affects IBM DataPower Gateway: SSRF in 10.0.2.0–10.0.4.0, 10.0.1.0–10.0.1.8, 10.5.0.0, and 2018.4.1.0–2018.4.1.21. The IBM security bulletin states a vulnerability leading to potential unauthorized requests from the system, enabling network enumeration or related impacts. Remediati...

CVE-2022-31776

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network...

CVE-2022-31775

The CVE-2022-31775 issue affects IBM DataPower Gateway and is an XML External Entity Injection (XXE) in XML data processing caused by insufficient filtering of external entities. Affected products/versions include DataPower Gateway 10.0.2.0–10.0.4.0, 10.0.1.0–10.0.1.8, 10.5.0.0, and 2018.4.1.0–20...

CVE-2022-31775

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...

CVE-2022-31774

CVE-2022-31774 affects IBM DataPower Gateway. Vulnerable in Web UI where lack of data validation/filtering lets attackers embed arbitrary JavaScript, potentially disclosing credentials in a trusted session. Affected versions include 10.0.1.0–10.0.1.8, 10.0.2.0–10.0.4.0, 10.5.0.0, and 2018.4.1.0–2...

CVE-2022-31774

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2022-22326

CVE-2022-22326 affects IBM DataPower Gateway and IBM MQ Appliance with insufficient authorization checks allowing unauthorized viewing of logs and files. Affected products and versions include IBM DataPower Gateway 10.0.1.0–10.0.1.5, 10.0.2.0–10.0.4.0, and 2018.4.1.0–2018.4.1.18; remediation upgr...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

PT-2022-15364 · Ibm · Ibm Datapower Gateway

Name of the Vulnerable Software and Affected Versions: IBM Datapower Gateway versions 10.0.1.0 through 10.0.1.5 IBM Datapower Gateway versions 10.0.2.0 through 10.0.4.0 IBM Datapower Gateway versions 2018.4.1.0 through 2018.4.1.18 Description: The issue is related to insufficient authorization...

CVE-2022-31776: Server-Side Request Forgery (SSRF)

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network...

CVE-2022-22326: Incorrect Authorization

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-31775: Improper Restriction of XML External Entity Reference

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...

PT-2022-20922 · Ibm · Ibm Datapower Gateway

Name of the Vulnerable Software and Affected Versions: IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.8 IBM DataPower Gateway versions 10.0.2.0 through 10.0.4.0 IBM DataPower Gateway version 10.5.0.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.21 Description: The issue is...

PT-2022-21444 · Ibm · Ibm Datapower Gateway

Name of the Vulnerable Software and Affected Versions: IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.8 IBM DataPower Gateway versions 10.0.2.0 through 10.0.4.0 IBM DataPower Gateway version 10.5.0.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.21 Description: This issue...

PT-2022-20920 · Ibm · Ibm Datapower Gateway

Name of the Vulnerable Software and Affected Versions: IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.8 IBM DataPower Gateway versions 10.0.2.0 through 10.0.4.0 IBM DataPower Gateway version 10.5.0.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.21 Description: This issue...

PT-2022-20921 · Ibm · Ibm Datapower Gateway

Name of the Vulnerable Software and Affected Versions: IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.8 IBM DataPower Gateway versions 10.0.2.0 through 10.0.4.0 IBM DataPower Gateway version 10.5.0.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.21 Description: The issue is...

CVE-2022-32750: Improper Neutralization of Input During Web Page Generation

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2022-31774: Improper Neutralization of Input During Web Page Generation

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in Redis

Summary IBM has addressed the following CVEs, which may affect Gateway Peering and Quota Enforcement. Vulnerability Details CVEID:CVE-2022-24736 DESCRIPTION: Redis is vulnerable to a denial of service, caused by a NULL pointer dereference. By loading a specially crafted Lua script, a local...

Security Bulletin: IBM DataPower Gateway affected by multiple vulnerabilities in Java

Summary While core IBM DataPower Gateway does not use Java, certain components shipped with IDG may be vulnerable. IBM has addressed the CVEs. Vulnerability Details CVEID:CVE-2022-21434 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...