Ibm Datapower Gateway vulnerabilities
81 known vulnerabilities affecting ibm/datapower_gateway.
Total CVEs
81
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL11HIGH40MEDIUM28LOW2
Vulnerabilities
Page 4 of 5
CVE-2026-14273P4MEDIUMCVSS 6.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14273 [MEDIUM] CWE-863 CVE-2026-14273: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
nvd
CVE-2022-40228P4MEDIUMCVSS 5.4≥ 10.0.1.0, ≤ 10.0.1.9≥ 10.0.3.0, ≤ 10.0.4.0+6 more2022-11-22
CVE-2022-40228 [MEDIUM] CWE-613 CVE-2022-40228: IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 20
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.
nvd
CVE-2026-16177P4MEDIUMCVSS 5.3≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16177 [MEDIUM] CWE-125 CVE-2026-16177: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
nvd
CVE-2026-13258P4MEDIUMCVSS 5.4≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-13258 [MEDIUM] CWE-79 CVE-2026-13258: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur
nvd
CVE-2021-38910P4MEDIUMCVSS 5.3≥ 10.0.1.0, ≤ 10.0.1.5≥ 2018.4.1.0, ≤ 2018.4.1.18+6 more2022-03-10
CVE-2021-38910 [MEDIUM] CWE-20 CVE-2021-38910: IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security r
IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID: 209824.
nvd
CVE-2020-5008P4MEDIUMCVSS 5.3≥ 10.0.0.0, ≤ 10.0.1.0≥ 2018.4.1.0, ≤ 2018.4.1.14+4 more2021-06-07
CVE-2020-5008 [MEDIUM] CWE-922 CVE-2020-5008: IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033.
nvd
CVE-2021-38944P4MEDIUMCVSS 6.1≥ 10.0.1.0, ≤ 10.0.1.5≥ 10.0.2.0, ≤ 10.0.3.0+7 more2022-05-18
CVE-2021-38944 [MEDIUM] CWE-79 CVE-2021-38944: IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 20
IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or sess
nvd
CVE-2017-1591P4MEDIUMCVSS 6.1v7.0.0.0v7.0.0.1+82 more2017-09-28
CVE-2017-1591 [MEDIUM] CWE-79 CVE-2017-1591: IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vul
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132368.
nvd
CVE-2018-1667P4MEDIUMCVSS 5.4≥ 7.5.0.0, ≤ 7.5.0.18≥ 7.5.1.0, ≤ 7.5.1.17+3 more2018-12-13
CVE-2018-1667 [MEDIUM] CWE-79 CVE-2018-1667: IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17,
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials discl
nvd
CVE-2022-31774P4MEDIUMCVSS 5.4≥ 10.0.1.0, ≤ 10.0.1.8≥ 10.0.2.0, < 10.5.0.1+8 more2022-08-01
CVE-2022-31774 [MEDIUM] CWE-79 CVE-2022-31774: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
nvd
CVE-2022-32750P4MEDIUMCVSS 5.4≥ 10.0.1.0, ≤ 10.0.1.8≥ 10.0.2.0, < 10.5.0.1+8 more2022-08-01
CVE-2022-32750 [MEDIUM] CWE-79 CVE-2022-32750: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
nvd
CVE-2020-4528P4MEDIUMCVSS 5.5≥ 2018.4.1.0, ≤ 2018.4.1.12v10.0.0.0+2 more2020-10-06
CVE-2020-4528 [MEDIUM] CVE-2020-4528: IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a l
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. IBM X-Force ID: 182658.
nvd
CVE-2015-7427P4MEDIUMCVSS 5.0≤ 6.0.0.16v6.0.1.0+34 more2015-11-14
CVE-2015-7427 [MEDIUM] CWE-200 CVE-2015-7427: IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x bef
IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http
nvd
CVE-2020-4203P4MEDIUMCVSS 4.9≥ 2018.4.1.0, ≤ 2018.4.1.8v2018.4.1.0+1 more2020-03-19
CVE-2020-4203 [MEDIUM] CVE-2020-4203: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive info
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. IBM X-Force ID: 174956.
nvd
CVE-2026-7366P4MEDIUMCVSS 4.2≥ 10.5.0.0, < 10.5.0.22≥ 10.6.0.0, < 10.6.0.10+1 more2026-08-12
CVE-2026-7366 [MEDIUM] CWE-362 CVE-2026-7366: IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated a
nvd
CVE-2018-1666P4MEDIUMCVSS 4.3≥ 7.5.0.0, ≤ 7.5.0.19≥ 7.5.1.0, ≤ 7.5.1.18+14 more2019-02-07
CVE-2018-1666 [MEDIUM] CVE-2018-1666: IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 throug
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892.
nvd
CVE-2018-1652P4MEDIUMCVSS 5.5≥ 7.1.0.0, ≤ 7.1.0.19≥ 7.2.0.0, ≤ 7.2.0.16+4 more2018-12-11
CVE-2018-1652 [MEDIUM] CWE-20 CVE-2018-1652: IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10,
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of service through unknown vectors. IBM X-Force ID: 144724.
nvd
CVE-2018-1677P4MEDIUMCVSS 5.5≥ 7.1.0.0, ≤ 7.1.0.22≥ 7.2.0.0, ≤ 7.2.0.20+5 more2018-12-20
CVE-2018-1677 [MEDIUM] CWE-755 CVE-2018-1677: IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 145171.
nvd
CVE-2017-1773P4MEDIUMCVSS 4.0≥ 7.1.0.0, ≤ 7.1.0.20≥ 7.2.0.0, ≤ 7.2.0.17+4 more2018-01-31
CVE-2017-1773 [MEDIUM] CWE-345 CVE-2017-1773: IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techni
IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning and redirect Internet traffic. IBM X-Force ID: 136817.
nvd
CVE-2015-7412P4LOWCVSS 2.6≤ 7.2.0.02015-11-08
CVE-2015-7412 [LOW] CWE-200 CVE-2015-7412: The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the G
The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.
nvd