IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not allow modification or denial of service but impacts confidentiality. The CVSS score is 7.7, indicating high severity.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL. This flaw could enable attackers with valid credentials to gather information about internal network services, potentially aiding further attacks. The vulnerability has a medium severity rating with a CVSS score of 5. No patch or remediation details are currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. This flaw allows a remote authenticated attacker to manipulate the OAuth 2.0 sign-in redirect address, which is insufficiently validated. As a result, authentication results could be redirected to an attacker-controlled location, enabling account takeover.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access sensitive information due to broken object-level authorization. This flaw affects confidentiality but does not impact integrity or availability. The vulnerability has a high severity rating with a CVSS score of 7.7.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform arbitrary file reads and server-side request forgery. This is due to insufficient restrictions on externally referenced content in submitted definitions, which can be exploited to retrieve content and return it to the attacker.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to take over ownership of organizations they do not control. This is due to incomplete access checks on organization objects, resulting in broken object-level authorization.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to improper certificate validation. This flaw could allow a remote attacker to obtain sensitive information and tamper with configuration settings. The vulnerability has a high severity rating with a CVSS score of 8. The issue is related to CWE-295, which involves improper certificate validation.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability is identified as CVE-2026-17296 and has a critical severity with a CVSS score of 9.6. The flaw impacts confidentiality and integrity but does not affect availability. No information about patches or fixes is provided.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper input validation of locations in service definitions can allow a remote authenticated attacker to access sensitive information. This occurs because the server may retrieve content it should not have access to when importing service definitions.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw impacts confidentiality but does not affect integrity or availability. The vulnerability has a high severity rating with a CVSS score of 7.7.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could perform unauthorized operations in other tenants' environments. This occurs due to insufficient verification of tenant context, allowing cross-tenant actions on resources.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could create unauthorized user accounts. This occurs due to improper verification of cryptographic signatures, allowing forged identity data from a login provider to be accepted without full signature validation.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to obtain sensitive information from the system. The vulnerability does not impact integrity or availability but can lead to a confidentiality breach.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability that could allow a remote attacker to perform an account takeover. The vulnerability arises because the redirect address used during sign-in is not sufficiently validated, enabling authentication results to be sent to an attacker-controlled location. This flaw has a critical severity with a CVSS score of 9.6.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where a hard-coded cryptographic key is used. This flaw could allow a remote attacker to obtain sensitive information without authentication. The vulnerability has a medium severity rating with a CVSS score of 6.5.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where incorrect type conversion can lead to denial of service. A remote authenticated attacker could exploit this flaw to cause the service to return invalid responses or become unavailable. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote attacker to bypass security restrictions via LDAP injection. This vulnerability has a medium severity rating with a CVSS score of 4.8. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass security restrictions. This occurs due to improper neutralization of special elements in request parameters, enabling specially crafted requests to circumvent protections.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability. A remote authenticated attacker could exploit this flaw to perform unauthorized actions, including deleting other users' API keys, due to missing authorization checks on certain operations.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.