IBM DataPower Gateways GatewayScript Module Information Disclosure Vulnerability

IBM DataPower Gateways is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads, which protects, integrates, and optimizes access across channels...

CVE-2015-7412: Exposure of Sensitive Information to an Unauthorized Actor

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attac...

PT-2015-7550

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateways versions 7.2.0.x before 7.2.0.1 Description The issue allows remote attackers to obtain plaintext data via a padding-oracle attack when the GatewayScript decryption API or a JWE decrypt action is enabled, as the...