PT-2016-5256

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliances versions 2.1 through 2.5 Description A buffer overflow issue in the CLI of IBM WebSphere DataPower XC10 appliances allows remote authenticated users to cause a denial of service via unspecified vectors...

CVE-2016-2870: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors...

PT-2015-5523

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.1.0.3 IBM WebSphere DataPower XC10 appliance versions 2.5 through 2.5.0.4 Description The issue allows physically proximate attackers to obtain sensitive information by extracting a...

CVE-2015-1970: Exposure of Sensitive Information to an Unauthorized Actor

The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere...

CVE-2015-1893: Undefined Security Weakness

The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors...

PT-2015-5491

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance version 2.1 before 2.1.0.3 Description The issue allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors...

PT-2014-7062

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.5 before FP4 Description The issue allows remote authenticated users to bypass intended grid-data access restrictions. Recommendations For IBM WebSphere DataPower XC10 appliance...

CVE-2014-6138: Exposure of Sensitive Information to an Unauthorized Actor

The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to bypass intended grid-data access restrictions via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-3058

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-6163

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6143: Exposure of Sensitive Information to an Unauthorized Actor

The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response...

CVE-2014-6163: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

PT-2014-7077

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.5 before FP4 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to...

PT-2014-7064

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 and 2.5 before FP4 Description The issue allows local users to obtain sensitive information by reading a response. Recommendations For IBM WebSphere DataPower XC10 appliance version 2.1, appl...

PT-2014-5052

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.5 before FP4 Description A cross-site request forgery CSRF issue allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...

CVE-2014-3058: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Code injection

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

PT-2014-5053

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance version 2.5 Description The issue allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network. Recommendations For IBM WebSphere...