CVE-2018-1664

This CVE affects IBM DataPower Gateway and IBM DataPower Gateway CD. The vulnerability is an information disclosure where echoing of AMP management interface authorization headers exposes login credentials in browser cache. Affected products/versions include IBM DataPower Gateway 7.1.0.0–7.1.0.23...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

CVE-2018-1669

CVE-2018-1669 affects IBM DataPower Gateway and DataPower Gateway CD, with XXE in XML processing. Affected: DataPower Gateway 7.1.0.0–7.1.0.23, 7.2.0.0–7.2.0.21, 7.5.0.0–7.5.0.16, 7.5.1.0–7.5.1.15, 7.5.2.0–7.5.2.15, 7.6.0.0–7.6.0.8 and CD 7.7.0.0–7.7.1.2. Impact: potential information disclosure ...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

CVE-2018-1669

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1669

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

Xxe

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

Security Bulletin: IBM DataPower Gateways is affected by a kernel vulnerability (CVE-2014-2523)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2014-2523 Vulnerability Details CVEID: CVE-2014-2523 DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by an error in the /netfilter/nfconntrackprotodccp.c file. By...

Security Bulletin: IBM DataPower Gateways management interface is affected by a vulnerability (CVE-2018-1664)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1664 Vulnerability Details CVEID: CVE-2018-1664 DESCRIPTION: IBM DataPower Gateways echoing of AMP management interface authorization headers exposes login credentials in browser cache. CVSS Base Score: 6.2 CVSS...

Security Bulletin: IBM DataPower Gateways is affected by an XXE vulnerability (CVE-2018-1669)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1669 Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2018-1669: Improper Restriction of XML External Entity Reference

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1664: Undefined Security Weakness

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

Security Bulletin: IBM DataPower Gateways is affected by a Denial of Service vulnerability (CVE-2018-7167)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-7167 Vulnerability Details CVEID: CVE-2018-7167 DESCRIPTION: Node.js is vulnerable to a denial of service. By invoking Buffer.fill or Buffer.alloc , a remote attacker could exploit this vulnerability to cause the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DataPower Gateways

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7, 7R1 and 8 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability related to the Java SE...

Security Bulletin: WebSphere DataPower Appliances is affected by a Denial of Service vulnerability (CVE-2018-0739)

Summary WebSphere DataPower Appliances has addressed the following vulnerability: CVE-2018-0739 Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploi...

Security Bulletin: WebSphere DataPower Appliances is affected by a Denial of Service vulnerability (CVE-2018-0732)

Summary WebSphere DataPower Appliances has addressed the following vulnerability: CVE-2018-0732 Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key...

Security Bulletin: WebSphere DataPower Appliances is affected by a vulnerability in OpenSSL (CVE-2018-0737)

Summary WebSphere DataPower Appliances has addressed the following vulnerability: CVE-2018-0737 Vulnerability Details CVEID: CVE-2018-0737 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a cache-timing side channel attack in the RSA Key generation...

Security Bulletin: Reuse of Source Port in DataPower DNS queries (CVE-2017-1773)

Summary IBM DataPower Gateway may re-use the source port in DNS lookups. IBM has addressed the applicable CVE Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-1773 DESCRIPTION: IBM WebSphere DataPower Appliances could allow an attacker using man-in-the-middle techniques to spoof DN...

Security Bulletin: A vulnerability in OpenSSL affects IBM DataPower Gateways (CVE-2016-2183)

Summary A vulnerability in the SSL/TLS protocol affects the ISAM Access Manager client and JMS. IBM DataPower Gateways has fully addressed the applicable CVE in version 7.5.2, and in earlier releases it was addressed with a combination of a code fix and a workaround. Vulnerability Details CVEID:...