IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to incomplete input validation. The flaw arises from improper input checks that can be bypassed, potentially exposing confidential data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No patch or remediation information is provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where missing authentication on a critical function allows remote attackers to access sensitive configuration data and perform unauthorized actions. This flaw affects the confidentiality, integrity, and availability of the affected systems.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not affect availability or integrity but impacts confidentiality. It requires the attacker to be authenticated and has a high severity rating.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML External Entity (XXE) injection that could allow a remote attacker to obtain sensitive information. This vulnerability has a high severity score of 8.2 and does not require user interaction or privileges to exploit. The flaw affects confidentiality but not integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to delete or overwrite arbitrary control-plane assets. This is due to an insecure direct object reference flaw. The vulnerability has a high severity with a CVSS score of 8.1.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs. This flaw could lead to a critical impact on confidentiality without requiring user interaction or privileges.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs. This flaw could be exploited without authentication and requires no user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.8.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to modify tool configuration and cause denial of service. The flaw arises because the system improperly relies on client-supplied information to determine user permissions, enabling unauthorized configuration changes that disrupt service.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This flaw could lead to high confidentiality impact with limited integrity impact and no availability impact.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a cross-site request forgery (CSRF) issue that could allow a remote attacker to force a user to authenticate into an attacker-controlled account. The vulnerability arises because the sign-in flow does not properly verify that a login response corresponds to the user's own authentication request, potentially linking the victim's session to the attacker's account.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow a remote attacker to obtain sensitive information from internal network resources. The vulnerability does not require authentication and has a medium severity rating.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could exploit improper validation of user-supplied URLs. This flaw allows the attacker to cause the server to contact internal network resources that should be restricted. The vulnerability has a medium severity rating with a CVSS score of 6.4.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to improper certificate validation. This flaw could allow a remote attacker to obtain sensitive credentials and manipulate tool responses. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability is identified as CVE-2026-17298 and has a critical severity rating with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization. This flaw impacts the integrity of API subscription management.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to obtain sensitive information from the affected system. The vulnerability has a medium severity rating with a CVSS score of 5.5.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw affects confidentiality but does not impact integrity or availability. The vulnerability has a medium severity rating with a CVSS score of 6.5.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass authentication via an alternate path. This flaw enables the attacker to obtain sensitive information and potentially take control of the gateway configuration. The vulnerability is identified as CVE-2026-17313 and has a critical severity rating with a CVSS score of 9.8.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to obtain sensitive information from the affected systems. The vulnerability has a high severity rating with a CVSS score of 8.5.