Security Bulletin: IBM DataPower Gateway: Update Redis to remediate two CVEs

Summary IBM has addressed the CVEs Vulnerability Details CVEID: CVE-2021-32626 DESCRIPTION: Redis is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By executing specially-crafted Lua scripts, a remote authenticated attacker could overflow a buffer and execute...

Security Bulletin: IBM DataPower Gateway vulnerable to HTTP header injection

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-38944 DESCRIPTION: IBM DataPower Gateway is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system...

PT-2022-9045

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.4 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.17 Description The issue allows a remote user to cause a temporary denial of service by sending invalid HTTP requests...

CVE-2021-38944

IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,...

IBM DataPower Gateway 安全漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...

CVE-2021-38872: Undefined Security Weakness

IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348...

CVE-2020-4994: Undefined Security Weakness

IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906...

PT-2022-10791

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.4 IBM DataPower Gateway versions 10.0.2.0 IBM DataPower Gateway versions 10.0.3.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.17 Description The issue allows a remote user t...

IBM DataPower Gateway 资源管理错误漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...

Security Bulletin: IBM DataPower Gateway API Gateway component potentially vulnerable to a Denial of Service

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-38872 DESCRIPTION: IBM DataPower Gateway could allow a remote user to cause a denial of service by consuming resources with multiple requests. CVSS Base score: 5.3 CVSS Temporal Score: See:...

Security Bulletin: Potential Denial of Service in IBM DataPower Gateway

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-22918 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds read in the libuv's uvidnatoascii function. By invoking the function using dns module's lookup function, a remote attacker could explo...

Security Bulletin: IBM DataPower vulnerable to DoS

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2020-4994 DESCRIPTION: IBM DataPower Gateway could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. CVSS Base score: 5.3 CVSS Temporal Score: See:...

CVE-2020-4994

IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906...

CVE-2021-38872

IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348...

Security Bulletin: IBM MQ Appliance affected by account enumeration and denial of service vulnerabilities (CVE-2022-22356 and CVE-2022-22355)

Summary IBM MQ Appliance has resolved account enumeration and denial of service vulnerabilities. Vulnerability Details CVEID: CVE-2022-22356 DESCRIPTION: IBM DataPower Gateway could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

Input validation

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

CVE-2021-38910

CVE-2021-38910 affects IBM DataPower Gateway V10CD (10.0.2.x+), 10.0.1, and 2108.4.1. The root cause is improper input validation, enabling a remote attacker to bypass security restrictions by sending a crafted JSON message to modify structure and fields. Documented impact is bypass of security c...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...