IBM WebSphere DataPower XC10 Appliance Multiple Vulnerabilities

Multiple vulnerabilities have been identified in IBM WebSphere DataPower XC10 Appliance, which can be exploited by remote authenticated user can gain administrative privileges or cause denial of service conditions.

1. A remote authenticated user can send specially crafted data to execute arbitrary JMX operations on the target system.
2. A remote user can send specially crafted data to stop server processes.
3. The product uses a common secret key for device-to-device communications. A remote user with knowledge of the key can impersonate appliance collective members.