IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to gain unauthorized access to sensitive API catalog and runtime configuration data. This occurs due to improper authentication where client-supplied information is insufficiently verified, enabling an attacker to impersonate a trusted party.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary JavaScript in the context of the user's browser because HTML content supplied by a provider is not properly sanitized before display.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to enumerate usernames by observing differences in response behavior. This issue could disclose valid usernames but does not impact confidentiality, integrity, or availability beyond that.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker can bypass security restrictions due to improper handling of case sensitivity. This inconsistency allows unauthorized emails to be sent by circumventing access controls.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability has a high severity with a CVSS score of 8.5. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access sensitive information of other tenants due to broken object-level authorization. This flaw impacts confidentiality but does not affect integrity or availability. The vulnerability has a high severity with a CVSS score of 7.7.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input. This vulnerability has a medium severity score of 4.3 and does not impact confidentiality or availability but can affect integrity. No official patch or remediation information is provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants. This is due to insufficient input validation of uploaded custom module content, which can be processed with privileges beyond the attacker's own tenant.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to obtain sensitive information due to verbose error messages. This information disclosure vulnerability has a medium severity rating with a CVSS score of 5.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This occurs due to improper control over code generation influenced by user-supplied input. The vulnerability has a low CVSS score of 3.3 and requires high attack complexity and privileges with no user interaction needed.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to gain elevated privileges due to improper authentication. This vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to access sensitive information due to an insecure direct object reference. The vulnerability has a medium severity rating with a CVSS score of 5.0. No public exploits or patches are currently documented.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. This flaw arises from missing authorization checks, enabling cross-tenant data compromise.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF). This occurs because when service definitions are imported, references to external resources are not properly restricted, enabling the server to access unauthorized resources.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary JavaScript and access sensitive information due to improper input validation. This vulnerability is classified as cross-site scripting (CWE-79) and has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper use of cryptography weakens the encryption protecting stored data. This flaw could allow a local attacker to obtain sensitive information. The vulnerability does not affect integrity or availability and requires local access with low attack complexity and no privileges.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference vulnerability that allows a remote authenticated attacker to obtain sensitive information and cause a denial of service. The vulnerability requires authentication and can lead to high confidentiality impact, limited integrity impact, and limited availability impact.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass restrictions on outbound requests. This could enable the attacker to make the server contact unintended destinations and obtain sensitive information from the responses.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary scripts in another user's browser session by exploiting insufficient validation of certain URL fields.