IBM DataPower Gateway Information Disclosure Vulnerability

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads that protects, integrates, and optimizes access across channels...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

CVE-2018-1669

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1664

This CVE affects IBM DataPower Gateway and IBM DataPower Gateway CD. The vulnerability is an information disclosure where echoing of AMP management interface authorization headers exposes login credentials in browser cache. Affected products/versions include IBM DataPower Gateway 7.1.0.0–7.1.0.23...

CVE-2018-1669

CVE-2018-1669 affects IBM DataPower Gateway and DataPower Gateway CD, with XXE in XML processing. Affected: DataPower Gateway 7.1.0.0–7.1.0.23, 7.2.0.0–7.2.0.21, 7.5.0.0–7.5.0.16, 7.5.1.0–7.5.1.15, 7.5.2.0–7.5.2.15, 7.6.0.0–7.6.0.8 and CD 7.7.0.0–7.7.1.2. Impact: potential information disclosure ...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

CVE-2018-1669

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1669

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1664

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

Authorization

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

Xxe

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

Security Bulletin: IBM DataPower Gateways is affected by a kernel vulnerability (CVE-2014-2523)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2014-2523 Vulnerability Details CVEID: CVE-2014-2523 DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by an error in the /netfilter/nfconntrackprotodccp.c file. By...

Security Bulletin: IBM DataPower Gateways management interface is affected by a vulnerability (CVE-2018-1664)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1664 Vulnerability Details CVEID: CVE-2018-1664 DESCRIPTION: IBM DataPower Gateways echoing of AMP management interface authorization headers exposes login credentials in browser cache. CVSS Base Score: 6.2 CVSS...

Security Bulletin: IBM DataPower Gateways is affected by an XXE vulnerability (CVE-2018-1669)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1669 Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2018-1669: Improper Restriction of XML External Entity Reference

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

PT-2018-13666

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.1.0.0 through 7.1.0.23 IBM DataPower Gateway versions 7.2.0.0 through 7.2.0.21 IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.16 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.15 IBM DataPower Gatew...

PT-2018-13690

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 7.1.0.0 through 7.1.0.23 IBM DataPower Gateway versions 7.2.0.0 through 7.2.0.21 IBM DataPower Gateway versions 7.5.0.0 through 7.5.0.16 IBM DataPower Gateway versions 7.5.1.0 through 7.5.1.15 IBM DataPower Gatew...

CVE-2018-1664: Undefined Security Weakness

IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cach...

Security Bulletin: IBM DataPower Gateways is affected by a Denial of Service vulnerability (CVE-2018-7167)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-7167 Vulnerability Details CVEID: CVE-2018-7167 DESCRIPTION: Node.js is vulnerable to a denial of service. By invoking Buffer.fill or Buffer.alloc , a remote attacker could exploit this vulnerability to cause the...

Security Bulletin: A Vulnerability in the Java runtime environment that IBM provides affects WebSphere DataPower XC10 Appliance

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7 that affects the WebSphere DataPower XC10 Appliance. This issue was disclosed as part of the IBM SDK, Java™ Technology Edition updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified...