CVE-2018-1665

Affected product and scope: IBM DataPower Gateway and related appliances are listed with CVE-2018-1665, affecting multiple VMF/RMF versions of DataPower Gateway and IBM MQ Appliance as detailed in IBM security bulletins. Root cause / vulnerability type: Use of weaker-than-expected cryptographic a...

CVE-2018-1667: Improper Neutralization of Input During Web Page Generation

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

PT-2018-13686

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.18 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.17 IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.17 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.10 IBM DataPower Gatew...

CVE-2018-1665: Inadequate Encryption Strength

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891...

PT-2018-13671

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.18 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.17 IBM DataPower Gateway versions 7.5.2.0 through 7.5.2.17 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0.10 IBM DataPower Gatew...

Security Bulletin: IBM DataPower Gateway is affected by a Denial of Service vulnerability (CVE-2018-1677)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1677 Vulnerability Details CVEID: CVE-2018-1677 DESCRIPTION: IBM DataPower Gateways and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker...

Security Bulletin: IBM DataPower Gateway is affected by a CSRF vulnerability (CVE-2018-1661)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1661 Vulnerability Details CVEID: CVE-2018-1661 DESCRIPTION: IBM DataPower Gateways is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted...

CVE-2018-1652

IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of...

CVE-2018-1652

IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of...

Security Bulletin: IBM DataPower Gateway is affected by a script injection vulnerability (CVE-2018-1667)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1667 Vulnerability Details CVEID: CVE-2018-1667 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI...

CVE-2018-1652: Improper Input Validation

IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of...

PT-2018-13608

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.1.0.0 through 7.1.0.19 IBM DataPower Gateway versions 7.2.0.0 through 7.2.0.16 IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.10 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.9 IBM DataPower Gatewa...

IBM DataPower Gateway Denial of Service Vulnerability

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads that protects, integrates, and optimizes access across channels...

IBM DataPower Gateway Information Disclosure Vulnerability (CNVD-2018-26363)

IBM DataPower Gateways is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads that protects, integrates, and optimizes access across channels...

Security Bulletin: IBM DataPower Gateways is affected by a downgrade vulnerability (CVE-2018-1663)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1663 Vulnerability Details CVEID: CVE-2018-1663 DESCRIPTION: IBM DataPower Gateways could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport...

Security Bulletin: IBM DataPower Gateway is affected by a Denial of Service vulnerability (CVE-2018-12115)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-12115 Vulnerability Details CVEID: CVE-2018-12115 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds write in Buffer. An attacker could exploit this vulnerability to write to memor...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DataPower Gateways

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 and 8 used by IBM DataPower Gateways. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-2952 DESCRIPTION: An unspecified vulnerability related to the Java SE...

IBM DataPower Gateway Detection

Detection of IBM DataPower Gateway. The script sends a connection request to the server and attempts to detect IBM DataPower Gateway and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

IBM DataPower Gateway XML External Entity Injection Vulnerability

IBM DataPower Gateways is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads that protects, integrates, and optimizes access across channels...

IBM DataPower Gateway Information Disclosure Vulnerability

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads that protects, integrates, and optimizes access across channels...