Ibm Datapower Gateway vulnerabilities
81 known vulnerabilities affecting ibm/datapower_gateway.
Total CVEs
81
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL11HIGH40MEDIUM28LOW2
Vulnerabilities
Page 3 of 5
CVE-2018-1668P3HIGHCVSS 7.5≥ 7.5.0.0, ≤ 7.5.0.19≥ 7.5.1.0, ≤ 7.5.1.18+10 more2019-01-29
CVE-2018-1668 [HIGH] CWE-287 CVE-2018-1668: IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18,
IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. IBM X-Force ID: 144894.
nvd
CVE-2020-4831P3HIGHCVSS 7.5≥ 10.0.0.0, ≤ 10.0.1.0v10.0.0.0+1 more2021-03-12
CVE-2020-4831 [HIGH] CWE-327 CVE-2020-4831: IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms t
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965.
nvd
CVE-2026-12733P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.22≥ 10.6.0.0, < 10.6.0.10+2 more2026-07-30
CVE-2026-12733 [HIGH] CWE-770 CVE-2026-12733: IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper res
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
nvd
CVE-2020-4579P3HIGHCVSS 7.5≥ 2018.4.1.0, ≤ 2018.4.1.12v2018.4.1.0+1 more2020-09-21
CVE-2020-4579 [HIGH] CVE-2020-4579: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID: 184438.
nvd
CVE-2020-4580P3HIGHCVSS 7.5≥ 2018.4.1.0, ≤ 2018.4.1.12v2018.4.1.0+1 more2020-09-21
CVE-2020-4580 [HIGH] CVE-2020-4580: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. IBM X-Force ID: 184439.
nvd
CVE-2018-1665P3HIGHCVSS 7.5≥ 7.5.0.0, ≤ 7.5.0.18≥ 7.5.1.0, ≤ 7.5.1.17+13 more2018-12-13
CVE-2018-1665 [HIGH] CWE-326 CVE-2018-1665: IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17,
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891.
nvd
CVE-2026-14507P3HIGHCVSS 7.7≥ 11.0.0.0, < 11.0.0.32026-10-08
CVE-2026-14507 [HIGH] CWE-787 CVE-2026-14507: IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.
nvd
CVE-2026-16169P3HIGHCVSS 7.5≥ 11.0.0.0, < 11.0.0.32026-10-08
CVE-2026-16169 [HIGH] CWE-400 CVE-2026-16169: IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of s
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
nvd
CVE-2018-1661P3HIGHCVSS 8.8≥ 7.5.0.0, ≤ 7.5.0.17≥ 7.5.1.0, ≤ 7.5.1.16+2 more2018-12-20
CVE-2018-1661 [HIGH] CWE-352 CVE-2018-1661: IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144887.
nvd
CVE-2026-13257P3MEDIUMCVSS 6.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-13257 [MEDIUM] CWE-345 CVE-2026-13257: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
nvd
CVE-2020-4581P3HIGHCVSS 7.5≥ 2018.4.1.0, ≤ 2018.4.1.12v2018.4.1.0+1 more2020-09-21
CVE-2020-4581 [HIGH] CVE-2020-4581: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. IBM X-Force ID: 184441.
nvd
CVE-2018-1664P3HIGHCVSS 7.8≥ 7.1.0.0, ≤ 7.1.0.23≥ 7.2.0.0, ≤ 7.2.0.21+5 more2018-09-25
CVE-2018-1664 [HIGH] CVE-2018-1664: IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cache. IBM X-Force ID: 144890.
nvd
CVE-2025-36373P4MEDIUMCVSS 6.8≥ 10.5.0.0, < 10.5.0.21≥ 10.6.0.0, < 10.6.0.9+1 more2026-04-01
CVE-2025-36373 [MEDIUM] CWE-497 CVE-2025-36373: IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 thr
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.
nvd
CVE-2020-4205P4MEDIUMCVSS 6.3≥ 2018.4.1.0, ≤ 2018.4.1.8v2018.4.1.0+1 more2020-03-19
CVE-2020-4205 [MEDIUM] CWE-287 CVE-2020-4205: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass secu
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after authentication certificates have been revolked. IBM X-Force ID: 174961.
nvd
CVE-2020-5014P4MEDIUMCVSS 6.7≥ 10.0.0.0, ≤ 10.0.1.1≥ 2018.4.1.0, ≤ 2018.4.1.14+4 more2021-03-08
CVE-2020-5014 [MEDIUM] CWE-918 CVE-2020-5014: IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to e
IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247.
nvd
CVE-2018-1663P4MEDIUMCVSS 5.9≥ 7.5.0.0, ≤ 7.5.0.17≥ 7.5.1.0, ≤ 7.5.1.16+4 more2018-12-07
CVE-2018-1663 [MEDIUM] CWE-200 CVE-2018-1663: IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain se
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.
nvd
CVE-2026-14509P4MEDIUMCVSS 5.9≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14509 [MEDIUM] CWE-400 CVE-2026-14509: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.
nvd
CVE-2020-4992P4MEDIUMCVSS 6.5≥ 2018.4.1.0, ≤ 2018.4.1.16v2018.4.1.0+1 more2021-08-17
CVE-2020-4992 [MEDIUM] CWE-352 CVE-2020-4992: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery whi
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737.
nvd
CVE-2026-16182P4MEDIUMCVSS 5.9≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16182 [MEDIUM] CWE-476 CVE-2026-16182: IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 t
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
nvd
CVE-2026-14521P4MEDIUMCVSS 4.9≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14521 [MEDIUM] CWE-918 CVE-2026-14521: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
nvd