CVE-2014-0852

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

Code injection

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

CVE-2014-0852

The CVE affects IBM WebSphere DataPower SOA Appliances. Affected versions include 4.0.2.15, 5.x up to 5.0.0.17, 6.0.0.x up to 6.0.0.9, and 6.0.1.x up to 6.0.1.5. Root cause: a SSL/TLS side-channel timing vulnerability that can reveal the PreMasterSecret when an attacker on the same LAN sends mill...

CVE-2014-0852

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

IBM WebSphere DataPower XML Security Gateway 3.6.1 XS40 Remote Denial Of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33169/info IBM WebSphere DataPower XML Security Gateway XS40 is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input. Remote attackers can exploit this issue to cause the device...

IBM WebSphere DataPower XC10 Administrative Access及Web Logoff漏洞

CVECAN ID: CVE-2013-5428,CVE-2013-5446 XC10设备是WebSphere DataPower硬件平台和IBM分布式缓存技术的结合。 IBM WebSphere DataPower XC10 2.5、2.1存在安全漏洞，可使未经身份验证的攻击者访问某些管理员操作，造成拒绝服务；并且在处理Web注销时也存在错误。 0 IBM WebSphere DataPower XC10 2.5 IBM WebSphere DataPower XC10 2.1 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2013-5446

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

CVE-2013-5428

IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via unspecified vectors...

Design/Logic Flaw

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

Authentication flaw

IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via unspecified vectors...

CVE-2013-5428

CVE-2013-5428 affects IBM WebSphere DataPower XC10 appliances (notably 2.5.0; also referenced for 2.1) where unauthenticated access to administrative actions can trigger a denial of service. Exploitation details are not provided in the documents. Vendor patches exist via IBM Fix Central and speci...

CVE-2013-5446

The issue affects IBM WebSphere DataPower XC10 appliances (2.1.0 and 2.5.0). The console does not properly process logoff actions, potentially enabling exploitation of admin-related functionality with remote access and causing denial of service, as described across multiple sources. Vendor patche...

CVE-2013-5446

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

CVE-2013-5403

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors...

Code injection

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors...

CVE-2013-5403

IBM WebSphere DataPower XC10 Appliance is affected (versions 2.0, 2.1, 2.5). CVE-2013-5403 describes an unauthenticated, remote-access vulnerability that allows administrative access to code and data. The IBM security bulletin confirms affected firmware ranges and provides remediation guidance: u...

CVE-2013-5403

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors...

IBM Websphere DataPower server detection

Binary data 6867.prm...

CVE-2013-0499

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

Cross site scripting

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...