IBM DataPower Gateway 资源管理错误漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...

Security Bulletin: IBM DataPower Gateway API Gateway component potentially vulnerable to a Denial of Service

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-38872 DESCRIPTION: IBM DataPower Gateway could allow a remote user to cause a denial of service by consuming resources with multiple requests. CVSS Base score: 5.3 CVSS Temporal Score: See:...

Security Bulletin: Potential Denial of Service in IBM DataPower Gateway

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-22918 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds read in the libuv's uvidnatoascii function. By invoking the function using dns module's lookup function, a remote attacker could explo...

Security Bulletin: IBM DataPower vulnerable to DoS

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2020-4994 DESCRIPTION: IBM DataPower Gateway could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. CVSS Base score: 5.3 CVSS Temporal Score: See:...

CVE-2020-4994

IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906...

CVE-2021-38872

IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348...

Security Bulletin: IBM MQ Appliance affected by account enumeration and denial of service vulnerabilities (CVE-2022-22356 and CVE-2022-22355)

Summary IBM MQ Appliance has resolved account enumeration and denial of service vulnerabilities. Vulnerability Details CVEID: CVE-2022-22356 DESCRIPTION: IBM DataPower Gateway could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

Input validation

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

CVE-2021-38910

CVE-2021-38910 affects IBM DataPower Gateway V10CD (10.0.2.x+), 10.0.1, and 2108.4.1. The root cause is improper input validation, enabling a remote attacker to bypass security restrictions by sending a crafted JSON message to modify structure and fields. Documented impact is bypass of security c...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

IBM DataPower Gateway 输入验证错误漏洞

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

Security Bulletin: IBM DataPower Gateway permits reflected JSON injection (CVE-2021-38910)

Summary IBM has addressed the CVE Vulnerability Details CVEID: CVE-2021-38910 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this...

CVE-2021-38910

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID:...

Security Bulletin: IBM DataPower affected by vulnerabilities in Node.js

Summary IBM has addressed the following CVEs that affect the APIC Gateway Service. Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request...

Security Bulletin: Multiple vulnerabilities in ICU libraries used in IBM DataPower Gateway

Summary IBM has addressed the following vulnerabilities in the ICU libraries used by drouter: CVE-2014-8147, CVE-2014-8146, CVE-2017-14952, CVE-2020-10531, Vulnerability Details CVEID: CVE-2014-8147 DESCRIPTION: ICU Project ICU4C library could allow a local attacker execute arbitrary code on the...

Security Bulletin: IBM DataPower Gateway vulnerable to a DoS

Summary IBM has addressed the following vulnerability within the Gateway Director component. Note that the vulnerability existed in only the immediately preceding version in all releases. Vulnerability Details CVEID: CVE-2020-8251 DESCRIPTION: Node.js is vulnerable to a denial of service, caused ...

Security Bulletin: Update Secure Gateway Client in IBM DataPower Gateway to address several CVEs

Summary Update the version of Node used by Secure Gateway Client component to address the listed CVEs. This issue affects only users of the Secure Gateway Client. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer...

IBM DataPower Gateway Code Injection Vulnerability

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...