CVE-2014-6163

The CVE-2014-6163 issue affects IBM WebSphere DataPower XC10 appliances (versions 2.1 and 2.5) before FP4. It is an XSS vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. The vulnerability impact is described as a client-side script inje...

CVE-2014-6143

The CVE-2014-6143 entry affects IBM WebSphere DataPower XC10 appliances версии 2.1 and 2.5 prior to FP4. The issue enables local users to obtain sensitive information by reading a response, indicating an information-disclosure vulnerability in the appliance’s response handling. The root cause is ...

PT-2014-7064

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 and 2.5 before FP4 Description The issue allows local users to obtain sensitive information by reading a response. Recommendations For IBM WebSphere DataPower XC10 appliance version 2.1, appl...

PT-2014-5052

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.5 before FP4 Description A cross-site request forgery CSRF issue allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...

CVE-2014-6143: Exposure of Sensitive Information to an Unauthorized Actor

The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response...

PT-2014-7077

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance versions 2.1 through 2.5 before FP4 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to...

CVE-2014-6163: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-3058: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-3059

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

Code injection

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3059

The CVE affects WebSphere DataPower XC10 Appliance version 2.5. In certain configurations, the XC10 Administrative Console could allow a malicious user to gain administrative access to the device (via the login session cookie/console access described by IBM). The IBM Security Bulletin lists affec...

CVE-2014-3060

The CVE-2014-3060 issue affects IBM WebSphere DataPower XC10 Appliance Version 2.5, where the Administrative Console could allow an attacker to gain administrative access by capturing a session cookie (via access to an eXtreme Scale distributed ObjectGrid network). The IBM Security Bulletin cites...

PT-2014-5053

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance version 2.5 Description The issue allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network. Recommendations For IBM WebSphere...

CVE-2014-3059

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3059: Undefined Security Weakness

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

PT-2014-5054

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance version 2.5 Description The issue allows remote attackers to gain administrative privileges. This can be achieved by accessing an eXtreme Scale distributed ObjectGrid network and capturing a session cooki...

CVE-2014-3060: Undefined Security Weakness

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-0852

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...