IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary OS commands. This is due to improper neutralization of user-supplied input before it is passed to the operating system, leading to command injection.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication vulnerability that could allow a remote attacker to obtain sensitive information and modify API configurations. The flaw arises from insufficient verification of identity information in requests, enabling impersonation of other users.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where remote authenticated attackers can bypass object-level authorization checks on keystore objects. This flaw allows unauthorized access to sensitive keystore information because the system does not properly verify user permissions for reading these objects.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization flaw that allows an authenticated user to obtain limited information about other organizations. This occurs because a token issued for a limited purpose is accepted where it should not be, potentially revealing organization names. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a stack-based buffer overflow vulnerability that allows a remote authenticated attacker to execute arbitrary code. This vulnerability is classified as CWE-121 and has a high severity with a CVSS score of 7.2.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to bypass address checks and access internal or otherwise restricted network destinations, potentially exposing sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or patch information are provided in the data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of hard-coded credentials. This flaw could allow a remote attacker to gain full administrative control of the affected systems. The vulnerability is rated critical with a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This occurs due to insufficient validation of uploaded content, enabling malicious code execution on the server.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary SQL commands because input values during sign-in are not properly sanitized before being used in database queries.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to induce the affected component to send requests to unintended destinations and retrieve the responses, potentially exposing sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to improper handling of case sensitivity. This flaw allows a remote attacker to bypass access controls inconsistently applied to different case variations of requests, enabling unauthorized administrative operations and access to sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have vulnerabilities to Regular Expression Denial of Service (ReDoS) attacks and improper neutralization of wildcard query operators. These flaws can lead to denial of service and potentially impact confidentiality. The vulnerabilities have a high CVSS score of 9.6, indicating critical severity. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact but limited integrity and no availability impact.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that allows an authenticated attacker to view, add, modify, or delete information in the back-end database. This occurs because input is not properly neutralized before being used in database queries.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 9.6, indicating critical impact on confidentiality and integrity without affecting availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No patch or remediation details are provided in the available data.