IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to induce the affected component to send requests to unintended destinations and retrieve the responses, potentially exposing sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to improper handling of case sensitivity. This flaw allows a remote attacker to bypass access controls inconsistently applied to different case variations of requests, enabling unauthorized administrative operations and access to sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have vulnerabilities to Regular Expression Denial of Service (ReDoS) attacks and improper neutralization of wildcard query operators. These flaws can lead to denial of service and potentially impact confidentiality. The vulnerabilities have a high CVSS score of 9.6, indicating critical severity. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact but limited integrity and no availability impact.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that allows an authenticated attacker to view, add, modify, or delete information in the back-end database. This occurs because input is not properly neutralized before being used in database queries.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 9.6, indicating critical impact on confidentiality and integrity without affecting availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No patch or remediation details are provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability that allows an authenticated user to execute arbitrary JavaScript in the web UI. This vulnerability could alter the page's intended functionality and potentially lead to credential disclosure within a trusted session.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access internal network resources. This occurs due to improper validation of user-supplied URLs, enabling the server to contact internal systems that should be restricted.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could access sensitive information from other tenants. This occurs due to insufficient validation of a path parameter, allowing unauthorized data access across tenant boundaries.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to modify object attributes improperly. This flaw enables an attacker to change access-related settings that should be system-controlled, potentially exposing sensitive information. The vulnerability is identified as CWE-915 and carries a critical severity with a CVSS score of 9.6.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 6.3, indicating medium severity.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to access sensitive information. This vulnerability requires authentication and does not allow denial of service but can lead to confidentiality breaches.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw affects confidentiality but does not impact integrity or availability. The vulnerability has a high severity rating with a CVSS score of 7.7.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass authentication and assign arbitrary roles. This occurs due to improper verification of cryptographic signatures.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability. A remote authenticated attacker could exploit improper authorization logic that relies on client-supplied information to access sensitive data they should not be authorized to view.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform SQL injection, potentially leading to unauthorized access to sensitive information. The vulnerability has a high severity with a CVSS score of 7.7. No public exploits or known in-the-wild exploitation have been reported. No patch or remediation information is currently provided.