CVE-2018-1665

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
IBM	DataPower Gateway	7.6.0.0; 7.6.0.10; 7.5.2.0; 7.5.2.17; 7.5.1.0; 7.5.1.17; 7.5.0.0; 7.7.0.0; 7.7.1.3; 7.5.0.18

References

http://www.ibm.com/support/docview.wss?uid=ibm10744195Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144891VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10744195Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144891VDB Entry, Vendor Advisory

Timeline

Published: Dec 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-166508.8phpMyFAQ before 2.9.11 allows CSRF.CVE-2018-166517.2The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.CVE-2018-166536.1rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.CVE-2018-166546.1Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.CVE-2018-166556.1Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.CVE-2018-166567.5DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users vi CVE-2018-166579.8In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Ka CVE-2018-166586.1An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be CVE-2018-166599.8An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Userna CVE-2018-16664.3IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, an CVE-2018-166608.8A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated acces CVE-2018-166637.8An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-pars