CVE-2013-0499

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

Cross site scripting

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

CVE-2013-0499

CVE-2013-0499 affects IBM WebSphere DataPower appliances (firmware 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0). The vulnerability is a cross-site scripting (XSS) flaw in the echo functionality used by XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token Service when configured to bl...

CVE-2013-0499

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

CVE-2013-0499: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gatew...

IBM WebSphere DataPower 3.8.2 / 4.0.x / 5.0 Cross Site Scripting

IBM WebSphere DataPower Integration Appliance XI50 versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0 suffer from a cross site scripting vulnerability. ======================================================================= title: JavaScript Execution in WebSphere DataPower Services product: IBM WebSphere...

CVE-2013-0600

Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors...

Authentication flaw

Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors...

CVE-2013-0600

Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors...

CVE-2013-0600

Technical details about CVE-2013-0600 are not publicly available in the provided documents. Monitor for updates.

CVE-2013-0600: Undefined Security Weakness

Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors...

CVE-2012-5758

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authentication for an unspecified interface, which allows remote attackers to cause a denial of service process exit via unknown vectors...

CVE-2012-5756

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

Authentication flaw

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authentication for an unspecified interface, which allows remote attackers to cause a denial of service process exit via unknown vectors...

Design/Logic Flaw

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 allows remote authenticated users to bypass intended administrative-role requirements and perform arbitrary JMX operations via unspecified vectors...

Code injection

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

CVE-2012-5756

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

CVE-2012-5758

CVE-2012-5758 affects IBM WebSphere DataPower XC10 Appliance versions 2.0.0.0–2.0.0.3 and 2.1.0.0–2.1.0.2. An unprotected interface allows an unauthorized user to stop the appliance server processes without authentication/authorization, causing a denial of service. The IBM security bulletin confi...

CVE-2012-5759

CVE-2012-5759 affects IBM WebSphere DataPower XC10 Appliance (versions 2.0.0.0–2.0.0.3 and 2.1.0.0–2.1.0.2). The issue allows remote authenticated users to bypass administrative-role requirements and perform arbitrary JMX operations via unspecified vectors. Impact is described as enabling adminis...

CVE-2012-5756

The CVE-2012-5756 entry concerns IBM WebSphere DataPower XC10 Appliance (versions 2.0.0.0–2.0.0.3 and 2.1.0.0–2.1.0.2). The root cause is a shared secret key used across different customers’ collective configurations, enabling a remote attacker to spoof a container server by either sniffing a cle...