IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where the backup server's identity is not properly verified during the establishment of secure connections for analytics backups. This flaw could allow a network-positioned attacker to intercept backup data and potentially credentials if used.
A vulnerability in The Directorist WordPress plugin before version 8.11 allows an administrator of one site in a multisite network to perform email-verification bulk actions on users of other sites without proper permission checks. This can result in locking out users, including the network Super Administrator, until they re-verify their email addresses.
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'update_block_style' endpoint. This affects all versions up to and including 3.19.9. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The WP Google Review Slider WordPress plugin versions prior to 18.11 lack nonce validation when updating the active Google Places configuration. This flaw allows attackers to modify or destroy the configuration by tricking a site administrator into clicking a crafted link.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability where tenant context verification is insufficient. This flaw allows an authenticated attacker to potentially access resources belonging to other tenants without proper authorization.
A cross-site scripting (XSS) vulnerability exists in the FV Flowplayer Video Player WordPress plugin before version 7.5.57.7212. The plugin fails to escape shortcode attribute values embedded in comments when rendering them into the media player markup. This allows unauthenticated visitors to store malicious script payloads in comments that execute in the context of any visitor who plays the commented video, including administrators, if the non-default comment-shortcode-parsing setting is enabled.
The Directorist WordPress plugin versions before 8.11 contain a vulnerability where the plugin does not verify ownership of attachment IDs when updating listing images. This flaw allows authenticated users with Subscriber-level access or higher to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their associated files.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability. A remote authenticated attacker could exploit improper authorization checks on request URL values to access sensitive information belonging to other users. This vulnerability does not impact integrity or availability but can lead to unauthorized information disclosure.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements in operating system commands, leading to command injection risks.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary OS commands. This is due to improper neutralization of user-supplied input before it is passed to the operating system, leading to command injection.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication vulnerability that could allow a remote attacker to obtain sensitive information and modify API configurations. The flaw arises from insufficient verification of identity information in requests, enabling impersonation of other users.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where remote authenticated attackers can bypass object-level authorization checks on keystore objects. This flaw allows unauthorized access to sensitive keystore information because the system does not properly verify user permissions for reading these objects.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization flaw that allows an authenticated user to obtain limited information about other organizations. This occurs because a token issued for a limited purpose is accepted where it should not be, potentially revealing organization names. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a stack-based buffer overflow vulnerability that allows a remote authenticated attacker to execute arbitrary code. This vulnerability is classified as CWE-121 and has a high severity with a CVSS score of 7.2.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to bypass address checks and access internal or otherwise restricted network destinations, potentially exposing sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or patch information are provided in the data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of hard-coded credentials. This flaw could allow a remote attacker to gain full administrative control of the affected systems. The vulnerability is rated critical with a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This occurs due to insufficient validation of uploaded content, enabling malicious code execution on the server.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary SQL commands because input values during sign-in are not properly sanitized before being used in database queries.