CVE-2025-36374: falha de média gravidade em IBM DataPower Gateway 10.5.0
IBM DataPower Gateway affected by XML external entity injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.4%
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Produtos afetados
IBM · DataPower Gateway 10.5.0IBM · DataPower Gateway 10.6.0IBM · DataPower Gateway 10.6CDCVEs relacionadas — IBM DataPower Gateway 10.5.0
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14497HIGHIBM DataPower Gateway Improper Verification of Cryptographic SignatureEPSS 0.6%CVE-2026-12733HIGHIBM DataPower Gateway affected by denial of serviceEPSS 0.5%CVE-2026-15762CRITICALIBM DataPower Gateway Out-of-bounds WriteEPSS 0.5%CVE-2026-16340CRITICALIBM DataPower Gateway Out-of-bounds WriteEPSS 0.5%CVE-2026-14269CRITICALIBM DataPower Gateway Buffer OverflowEPSS 0.5%CVE-2026-14991CRITICALIBM DataPower Gateway Out-of-bounds WriteEPSS 0.4%