Summary
Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
Product
Das DataPower Gateway ist eine Software zur Unterstützung von Unternehmen bei der Erfüllung der Sicherheits- und Integrationsanforderungen.
Vulnerabilities 3
-
High 7.5
IBM DataPower Gateway affected by denial of service
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
-
High 7.4
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access …
-
Medium 5.5
IBM DataPower Gateway affected by XML external entity injection
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-210545, EUVD-2026-51259
-
#1
Initiale Fassung
References
-
IBM Security Bulletin 7278746 vom 2026-07-01
https://www.ibm.com/support/pages/node/7278746
-
IBM Security Bulletin 7278747 vom 2026-07-01
https://www.ibm.com/support/pages/node/7278747
-
IBM Security Bulletin 7278748 vom 2026-07-01
https://www.ibm.com/support/pages/node/7278748