CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38910
https://notcve.org/view.php?id=CVE-2021-38910
10 Mar 2022 — IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID: 209824. IBM DataPower Gateway versiones V10CD, 10.0.1 y 2108.4.1, podría permitir a un atacante remoto omitir las restricciones de seguridad, causado por una comprobación incorrecta de la entrada. Al enviar un mensaje... • https://exchange.xforce.ibmcloud.com/vulnerabilities/209824 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5008
https://notcve.org/view.php?id=CVE-2020-5008
07 Jun 2021 — IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033. IBM DataPower Gateway versiones 10.0.0.0 hasta 10.0.1.0 y versiones 2018.4.1.0 hasta 2018.4.1.14, almacena información confidencial en los parámetros de petición GET. Esto puede conllevar a una divulgación de... • https://exchange.xforce.ibmcloud.com/vulnerabilities/193033 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 6.7EPSS: 1%CPEs: 2EXPL: 1CVE-2020-5014
https://notcve.org/view.php?id=CVE-2020-5014
08 Mar 2021 — IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247. IBM DataPower Gateway versiones V10 y V2018, podrían permitir a un atacante local con privilegios administrativos ejecutar código arbitrario en el sistema usando un ataque de tipo server-side request forgery. IBM X-Force ID: 193247 • https://github.com/copethomas/datapower-redis-rce-exploit • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2020-4528
https://notcve.org/view.php?id=CVE-2020-4528
06 Oct 2020 — IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. IBM X-Force ID: 182658. IBM MQ Appliance (IBM DataPower Gateway versiones 10.0.0.0 y 2018.4.1.0 hasta 2018.4.1.12), podría permitir a un usuario local, en condiciones especiales, obtener información altamente confidencial de los archivos de registro. IBM X-Force ID: 182658 • https://exchange.xforce.ibmcloud.com/vulnerabilities/182658 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-4621
https://notcve.org/view.php?id=CVE-2019-4621
09 Dec 2019 — IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883. IBM DataPower Gateway versiones 7.6.0.0-7 hasta 6.0.14 y versiones 2018.4.1.0 hasta 2018.4.1.5, presentan una cuenta de administrador predeterminada que está habilitada si el canal LAN de IPMI está habilitado. Un atacante remoto podría ut... • https://exchange.xforce.ibmcloud.com/vulnerabilities/168883 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 8.4EPSS: 0%CPEs: 6EXPL: 0CVE-2019-4294
https://notcve.org/view.php?id=CVE-2019-4294
20 Aug 2019 — IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188. IBM DataPower Gateway 2018.4.1.0 a 2018.4.1.6, 7.6.0.0 a 7.6.0.15 e IBM MQ Appliance 8.0.0.0 a 8.0.0.12, 9.1.0.0 a 9.1.0.2 y 9.1.1 a 9.1.2 podría permitir que un atacante local ejecute comandos ar... • https://exchange.xforce.ibmcloud.com/vulnerabilities/160701 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2018-1666
https://notcve.org/view.php?id=CVE-2018-1666
07 Feb 2019 — IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892. IBM DataPower Gateway, en su versión 2018.4.1.0, desde la versión 7.6.0.0 hasta la 7.6.0.11, desde la 7.5.2.0 hasta la 7.5.2.18, desde la 7.5.1.0 hasta la 7.5.1.18, desde la 7.5.0.0 hasta la 7.5.0.19 y desde la 7.7.0.0 hasta... • https://exchange.xforce.ibmcloud.com/vulnerabilities/144892 •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2018-1663
https://notcve.org/view.php?id=CVE-2018-1663
07 Dec 2018 — IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889. IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6 y 2018.4 podría permitir que un atacante remoto obtenga información sensible, provocado por la imposibilidad de habilitar correctamente... • http://www.securityfocus.com/bid/106199 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •