PT-2018-13733

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateways versions 7.1 through 7.7 IBM MQ Appliance affected versions not specified Description The issue is caused by the improper handling of a full file system, which could allow a local attacker to exploit it and cause a denia...

CVE-2018-1677: Improper Handling of Exceptional Conditions

IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 145171...

CVE-2018-1661: Cross-Site Request Forgery (CSRF)

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144887...

CVE-2018-1665

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891...

Cross site scripting

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Code injection

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891...

CVE-2018-1667

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2018-1665

Affected product and scope: IBM DataPower Gateway and related appliances are listed with CVE-2018-1665, affecting multiple VMF/RMF versions of DataPower Gateway and IBM MQ Appliance as detailed in IBM security bulletins. Root cause / vulnerability type: Use of weaker-than-expected cryptographic a...

PT-2018-13671

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.18 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.17 IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.17 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.10 IBM DataPower Gatew...

PT-2018-13686

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.18 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.17 IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.17 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.10 IBM DataPower Gatew...

CVE-2018-1665: Inadequate Encryption Strength

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891...

CVE-2018-1667: Improper Neutralization of Input During Web Page Generation

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM DataPower Gateway is affected by a Denial of Service vulnerability (CVE-2018-1677)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1677 Vulnerability Details CVEID: CVE-2018-1677 DESCRIPTION: IBM DataPower Gateways and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker...

Code injection

IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of...

Security Bulletin: IBM DataPower Gateway is affected by a script injection vulnerability (CVE-2018-1667)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1667 Vulnerability Details CVEID: CVE-2018-1667 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI...

CVE-2018-1652: Improper Input Validation

IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of...

PT-2018-13608

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.1.0.0 through 7.1.0.19 IBM DataPower Gateway versions 7.2.0.0 through 7.2.0.16 IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.10 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.9 IBM DataPower Gatewa...

Information disclosure

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2018-1663

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

Security Bulletin: IBM DataPower Gateways is affected by a Denial of Service vulnerability (CVE-2018-1652)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1652 Vulnerability Details CVEID: CVE-2018-1652 DESCRIPTION: IBM DataPower Gateways and IBM MQ Appliance could allow a local user to cause a denial of service through unknown vectors. CVSS Base Score: 6.2 CVSS...