CVE-2014-6143

The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response...

CVE-2014-6143

The CVE-2014-6143 entry affects IBM WebSphere DataPower XC10 appliances версии 2.1 and 2.5 prior to FP4. The issue enables local users to obtain sensitive information by reading a response, indicating an information-disclosure vulnerability in the appliance’s response handling. The root cause is ...

CVE-2014-3058

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-6163

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6163

The CVE-2014-6163 issue affects IBM WebSphere DataPower XC10 appliances (versions 2.1 and 2.5) before FP4. It is an XSS vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. The vulnerability impact is described as a client-side script inje...

CVE-2014-3058: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-6163: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6143: Exposure of Sensitive Information to an Unauthorized Actor

The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3059

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

Code injection

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3059

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3060: Undefined Security Weakness

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3059: Undefined Security Weakness

Unspecified vulnerability in the Administrative Console on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network...

CVE-2014-3059

The CVE affects WebSphere DataPower XC10 Appliance version 2.5. In certain configurations, the XC10 Administrative Console could allow a malicious user to gain administrative access to the device (via the login session cookie/console access described by IBM). The IBM Security Bulletin lists affec...

CVE-2014-3060

The CVE-2014-3060 issue affects IBM WebSphere DataPower XC10 Appliance Version 2.5, where the Administrative Console could allow an attacker to gain administrative access by capturing a session cookie (via access to an eXtreme Scale distributed ObjectGrid network). The IBM Security Bulletin cites...

CVE-2014-0852

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

Code injection

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

CVE-2014-0852

The CVE affects IBM WebSphere DataPower SOA Appliances. Affected versions include 4.0.2.15, 5.x up to 5.0.0.17, 6.0.0.x up to 6.0.0.9, and 6.0.1.x up to 6.0.1.5. Root cause: a SSL/TLS side-channel timing vulnerability that can reveal the PreMasterSecret when an attacker on the same LAN sends mill...