IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper control in the generation of code within the affected versions. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote authenticated attacker to execute arbitrary code. The issue arises because file paths in uploaded content are not properly validated, enabling files to be written outside intended directories and potentially leading to code execution.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability if exploited.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass security restrictions due to improper certificate validation. This flaw could enable an attacker to compromise confidentiality and integrity of the system without requiring user interaction.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF). This flaw can enable the attacker to access internal resources and cause a denial of service condition.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. This flaw could lead to a confidentiality breach without impacting integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference. This vulnerability has a high severity rating with a CVSS score of 7.7. No patch or remediation details are provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to read arbitrary files on the server. This is due to external control of a file name or path, which can lead to unauthorized disclosure of sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a local attacker to obtain sensitive credentials by causing sensitive information to be inserted into log files. This exposure could lead to account compromise.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote attacker to perform server-side request forgery (SSRF) due to improper validation of user-supplied input. This vulnerability has a high severity rating with a CVSS score of 7.2. No specific patch or fixed version information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper authentication. This flaw could lead to unauthorized access with high confidentiality and integrity impact but no availability impact is indicated.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to incomplete input validation. The flaw arises from improper input checks that can be bypassed, potentially exposing confidential data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No patch or remediation information is provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where missing authentication on a critical function allows remote attackers to access sensitive configuration data and perform unauthorized actions. This flaw affects the confidentiality, integrity, and availability of the affected systems.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not affect availability or integrity but impacts confidentiality. It requires the attacker to be authenticated and has a high severity rating.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML External Entity (XXE) injection that could allow a remote attacker to obtain sensitive information. This vulnerability has a high severity score of 8.2 and does not require user interaction or privileges to exploit. The flaw affects confidentiality but not integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to delete or overwrite arbitrary control-plane assets. This is due to an insecure direct object reference flaw. The vulnerability has a high severity with a CVSS score of 8.1.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs. This flaw could lead to a critical impact on confidentiality without requiring user interaction or privileges.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs. This flaw could be exploited without authentication and requires no user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.8.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to modify tool configuration and cause denial of service. The flaw arises because the system improperly relies on client-supplied information to determine user permissions, enabling unauthorized configuration changes that disrupt service.