IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to obtain sensitive information from the system. The vulnerability does not impact integrity or availability but can lead to a confidentiality breach.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability that could allow a remote attacker to perform an account takeover. The vulnerability arises because the redirect address used during sign-in is not sufficiently validated, enabling authentication results to be sent to an attacker-controlled location. This flaw has a critical severity with a CVSS score of 9.6.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where a hard-coded cryptographic key is used. This flaw could allow a remote attacker to obtain sensitive information without authentication. The vulnerability has a medium severity rating with a CVSS score of 6.5.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where incorrect type conversion can lead to denial of service. A remote authenticated attacker could exploit this flaw to cause the service to return invalid responses or become unavailable. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote attacker to bypass security restrictions via LDAP injection. This vulnerability has a medium severity rating with a CVSS score of 4.8. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass security restrictions. This occurs due to improper neutralization of special elements in request parameters, enabling specially crafted requests to circumvent protections.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability. A remote authenticated attacker could exploit this flaw to perform unauthorized actions, including deleting other users' API keys, due to missing authorization checks on certain operations.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote attacker to obtain sensitive information by exploiting an observable response discrepancy. This issue is classified under CWE-200 (Information Exposure). The vulnerability has a medium severity with a CVSS score of 5.8. No public exploits or known active exploitation have been reported, and no patch or remediation details are provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 6.4. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The flaw arises from improper authorization controls within the affected versions.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to access sensitive information. The vulnerability requires authentication and does not allow code execution but can lead to information disclosure.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain information about internal network services. This occurs due to improper validation of user-supplied URLs, enabling the server to be induced to contact internal systems. The vulnerability has a medium severity rating with a CVSS score of 6.4.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries. This occurs due to insufficient validation of request parameters, enabling circumvention of analytics data restrictions.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization flaw that could allow a remote authenticated attacker to access sensitive information. The vulnerability arises because authorization checks are not enforced when resolving certain organization URLs, potentially exposing data belonging to other organizations.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by triggering uncontrolled resource consumption. Certain crafted requests can cause internal processing to stall, potentially making the service unavailable.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a vulnerability where verbose error messages disclose sensitive system information. This could aid a remote authenticated attacker in gathering details about the environment. The vulnerability is rated medium severity with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to bypass security restrictions due to inconsistent application of authentication checks. This flaw enables access to protected resources without valid credentials.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where insufficient validation of path parameters allows a remote authenticated attacker to access sensitive information belonging to other tenants.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass destination restrictions on outbound requests. This server-side request forgery (SSRF) flaw could enable the attacker to retrieve sensitive information from unintended resources.