IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw could lead to unauthorized data disclosure without impacting data integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 7.7. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authentication bypass vulnerability. This flaw allows a remote authenticated attacker to bypass tenant isolation, potentially gaining access to another tenant's resources due to insufficiently isolated authentication checks.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access sensitive information belonging to other tenants. This occurs due to broken object-level authorization, which improperly restricts access controls between tenants.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to induce the server to send requests to unintended destinations and retrieve sensitive credentials. The vulnerability impacts confidentiality but does not affect integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of hard-coded credentials. This flaw could allow a remote attacker to gain full administrative control over the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to forge audit records due to improper output neutralization for logs. This could lead to integrity issues in audit logs, potentially obscuring malicious activity. The vulnerability has a medium severity rating with a CVSS score of 5. No information about available patches or fixes is provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an LDAP injection vulnerability. This flaw allows a remote authenticated attacker to manipulate directory queries by injecting malicious input, potentially gaining unauthorized administrative access to other tenants within the system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authentication vulnerability. A remote authenticated attacker could exploit improper authentication in the sign-in flow to obtain an access token for another user, effectively assuming that user's identity.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw impacts confidentiality but does not affect system availability. The vulnerability has a high severity rating with a CVSS score of 8.5.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. The issue arises from improper control over code generation influenced by user-supplied input, potentially leading to critical system compromise.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability due to the use of a cryptographically weak pseudo-random number generator. This weakness could allow a remote attacker to gain full administrative control of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.1. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity rating with a CVSS score of 8.5. No patch or remediation details are provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an LDAP injection vulnerability. This flaw allows a remote attacker to manipulate LDAP directory queries by injecting malicious input that is not properly neutralized. As a result, the attacker could retrieve sensitive information from the connected LDAP directory. The vulnerability has a medium severity rating with a CVSS score of 5.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information. This occurs due to improper authorization validation involving user-controlled keys.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability where a local attacker could obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator. This weakness affects the confidentiality of data but does not impact integrity or availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to the exposure of sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or known active exploitation have been reported. The affected versions are explicitly stated in the advisory.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where remote authenticated attackers can exploit insufficient validation of webhook destination URLs. This flaw allows attackers to cause the server to contact internal network resources, potentially probing internal systems.