Security Bulletin: IBM DataPower Gateway is affected by Denial of Service vulnerabilities

Summary IBM DataPower Gateway has addressed the following vulnerabilities: CVE-2019-11479 CVE-2019-11478 CVE-2019-11477 Vulnerability Details CVEID: CVE-2019-11479 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a flaw when processing minimum segment size MSS. By sending...

Security Bulletin: IBM DataPower Gateway is affected by Denial of Service vulnerabilities

Summary IBM DataPower Gateway has addressed the following vulnerabilities: CVE-2019-9513 CVE-2019-9511 Vulnerability Details CVEID: CVE-2019-9513 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Resource Loop attack. By creating multiple request streams and...

Security Bulletin: IBM DataPower Gateway is affected by a vulnerability (CVE-2018-1665)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1665 Vulnerability Details CVEID: CVE-2018-1665 DESCRIPTION: IBM DataPower Gateways uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base...

Security Bulletin: IBM DataPower Gateway appliances are affected by a vulnerability in IPMI (CVE-2018-1668)

Summary IBM DataPower Gateway Appliances has addressed the following vulnerability: CVE-2018-1668 Vulnerability Details CVEID: CVE-2018-1668 DESCRIPTION: IBM WebSphere DataPower Appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. CVSS Base...

Security Bulletin: IBM DataPower Gateway is affected by a vulnerability in Node.js (CVE-2018-12123)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-12123 Vulnerability Details CVEID: CVE-2018-12123 DESCRIPTION: Node.js is vulnerable to HTTP request splitting attacks, caused by improper input validation by the path option of an HTTP request. A remote attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataPower Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2816 DESCRIPTION: An unspecified vulnerability related to the Java SE Networking...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataPower Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: IBM DataPower Gateway is affected by an injection vulnerability (CVE-2019-4294)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2019-4294 Vulnerability Details CVEID: CVE-2019-4294 DESCRIPTION: IBM DataPower and IBM MQ Appliance could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability...

IBM DataPower Gateway Information Disclosure Vulnerability (CNVD-2021-40051)

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

CVE-2020-5008

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

Information disclosure

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

PT-2021-12279

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.0.0 through 10.0.1.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.14 Description The issue is related to the storage of sensitive information in GET request parameters, which may lead to...

CVE-2020-5008: Insecure Storage of Sensitive Information

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

IBM DataPower Gateway Weak Encryption Algorithm Vulnerability

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A weak cryptographic algorithm vulnerability exists in IBM DataPower Gateway 10.0.0.0 - 10.0.1.0. An attacker could exploit the vulnerability to decrypt highl...

PT-2021-12191

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.0.0 through 10.0.1.0 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For I...

CVE-2020-4831: Use of a Broken or Risky Cryptographic Algorithm

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

CVE-2020-4831

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

IBM DataPower Gateway 加密问题漏洞

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A weak cryptographic algorithm vulnerability exists in IBM DataPower Gateway 10.0.0.0 - 10.0.1.0. An attacker could exploit the vulnerability to decrypt highl...

IBM DataPower Gateway Server-Side Request Forgery Vulnerability

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A server-side request forgery vulnerability exists in IBM DataPower Gateway 10.0.0.0-10.0.1.1, 2018.4.1.0-2018.4.1.14. A local attacker with administrative...

CVE-2020-5014

IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247...