CVSS: 8.4EPSS: 0%CPEs: 6EXPL: 0CVE-2019-4294
https://notcve.org/view.php?id=CVE-2019-4294
20 Aug 2019 — IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188. IBM DataPower Gateway 2018.4.1.0 a 2018.4.1.6, 7.6.0.0 a 7.6.0.15 e IBM MQ Appliance 8.0.0.0 a 8.0.0.12, 9.1.0.0 a 9.1.0.2 y 9.1.1 a 9.1.2 podría permitir que un atacante local ejecute comandos ar... • https://exchange.xforce.ibmcloud.com/vulnerabilities/160701 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 84EXPL: 0CVE-2017-1591
https://notcve.org/view.php?id=CVE-2017-1591
27 Sep 2017 — IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132368. IBM WebSphere DataPower Appliances versión 7.0.0 hasta 7.6, es vulnerable a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a los usuarios insertar código JavaScript arbitrario en la i... • http://www.ibm.com/support/docview.wss?uid=swg22008815 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 36EXPL: 0CVE-2015-7427
https://notcve.org/view.php?id=CVE-2015-7427
14 Nov 2015 — IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session. Dispositivos IBM DataPower Gateway con firmware 6.x en versiones anteriores a 6.0.0.17, 6.0.1.x en versiones anteriores a 6.0.1.17, 7.x en versiones a... • http://www-01.ibm.com/support/docview.wss?uid=swg1IT10279 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7412
https://notcve.org/view.php?id=CVE-2015-7412
08 Nov 2015 — The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack. Los módulos GatewayScript en IBM DataPower Gateways con software 7.2.0.x en versiones anteriores a 7.2.0.1, cuando la API de descifrado GatewayScript o una acción de descifrado JWE está activada, no requiere dato... • http://www-01.ibm.com/support/docview.wss?uid=swg1IT10701 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •