Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataPower Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2816 DESCRIPTION: An unspecified vulnerability related to the Java SE Networking...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataPower Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: IBM DataPower Gateway Java security update

Summary IBM has addressed the following JRE CVEs: CVE-2020-14621, CVE-2020-14579, CVE-2020-14578, CVE-2020-14577, CVE-2020-2757, CVE-2020-2756, CVE-2020-2755, CVE-2020-2754 Vulnerability Details CVEID: CVE-2020-14621 DESCRIPTION: An unspecified vulnerability in Java SE related to the JAXP compone...

Security Bulletin: IBM DataPower Gateway is affected by an injection vulnerability (CVE-2019-4294)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2019-4294 Vulnerability Details CVEID: CVE-2019-4294 DESCRIPTION: IBM DataPower and IBM MQ Appliance could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability...

Security Bulletin: IBM DataPower Gateway vulnerable to an RCE attack (CVE-2020-5014)

Summary IBM has addressed the relevant CVE Vulnerability Details CVEID: CVE-2020-5014 DESCRIPTION: IBM DataPower Gateway could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. CVSS Base score: 6.7 CVSS Tempor...

Security Bulletin: IBM DataPower Gateway appliances are affected by a vulnerability in IPMI (CVE-2018-1668)

Summary IBM DataPower Gateway Appliances has addressed the following vulnerability: CVE-2018-1668 Vulnerability Details CVEID: CVE-2018-1668 DESCRIPTION: IBM WebSphere DataPower Appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. CVSS Base...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM DataPower Gateway (CVE-2018-3180)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 & 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability related to the Java SE component...

Security Bulletin: IBM DataPower Gateway is affected by Denial of Service vulnerabilities

Summary IBM DataPower Gateway has addressed the following vulnerabilities: CVE-2019-11479 CVE-2019-11478 CVE-2019-11477 Vulnerability Details CVEID: CVE-2019-11479 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a flaw when processing minimum segment size MSS. By sending...

IBM DataPower Gateway Information Disclosure Vulnerability (CNVD-2021-40051)

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

CVE-2020-5008

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

CVE-2020-5008

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

Information disclosure

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

CVE-2020-5008

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

PT-2021-12279

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.0.0 through 10.0.1.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.14 Description The issue is related to the storage of sensitive information in GET request parameters, which may lead to...

CVE-2020-5008: Insecure Storage of Sensitive Information

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

IBM DataPower Gateway security vulnerabilities

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

IBM DataPower Gateway Weak Encryption Algorithm Vulnerability

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A weak cryptographic algorithm vulnerability exists in IBM DataPower Gateway 10.0.0.0 - 10.0.1.0. An attacker could exploit the vulnerability to decrypt highl...

CVE-2020-4831

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

Code injection

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

CVE-2020-4831

CVE-2020-4831 affects IBM DataPower Gateway 10.0.0.0–10.0.1.0, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Connected IBM advisories confirm the vulnerability in DataPower Gateway and provide remediation: upgrade to IBM DataP...