IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper neutralization of special elements in SQL commands. This issue is classified as an SQL Injection vulnerability (CWE-89) and has a high severity score of 7.7. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass authentication and inject unauthorized configuration changes. This occurs due to improper certificate validation.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to obtain sensitive information. The vulnerability exists because an unauthenticated service can be induced to send requests to unintended destinations, potentially exposing confidential data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to access internal network services. The vulnerability has a high severity with a CVSS score of 7.6, indicating significant potential impact on confidentiality and integrity.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability has a high severity with a CVSS score of 8.5. No patch or remediation details are provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where a hard-coded cryptographic key is used. This flaw could allow a local attacker to obtain sensitive information. The vulnerability is classified as high severity with a CVSS score of 8.7.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw can lead to unauthorized data disclosure with high impact on confidentiality, integrity, and availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper certificate validation could allow a remote authenticated attacker to bypass authentication. The certificate check is not reliably performed in all cases, potentially permitting unauthorized connections.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote attacker to perform server-side request forgery (SSRF) and relay unauthorized email messages. This occurs due to improper neutralization of user-supplied input. The vulnerability has a high severity with a CVSS score of 7.2.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass destination checks on outbound requests. This server-side request forgery (SSRF) flaw could enable the attacker to access sensitive information from internal network resources that should be blocked.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability that could allow a remote authenticated attacker to access or modify sensitive information without proper authorization.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper control in the generation of code within the affected versions. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote authenticated attacker to execute arbitrary code. The issue arises because file paths in uploaded content are not properly validated, enabling files to be written outside intended directories and potentially leading to code execution.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability if exploited.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to bypass security restrictions due to improper certificate validation. This flaw could enable an attacker to compromise confidentiality and integrity of the system without requiring user interaction.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF). This flaw can enable the attacker to access internal resources and cause a denial of service condition.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. This flaw could lead to a confidentiality breach without impacting integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference. This vulnerability has a high severity rating with a CVSS score of 7.7. No patch or remediation details are provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to read arbitrary files on the server. This is due to external control of a file name or path, which can lead to unauthorized disclosure of sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a local attacker to obtain sensitive credentials by causing sensitive information to be inserted into log files. This exposure could lead to account compromise.