IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants. This is due to insufficient input validation of uploaded custom module content, which can be processed with privileges beyond the attacker's own tenant.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to obtain sensitive information due to verbose error messages. This information disclosure vulnerability has a medium severity rating with a CVSS score of 5.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This occurs due to improper control over code generation influenced by user-supplied input. The vulnerability has a low CVSS score of 3.3 and requires high attack complexity and privileges with no user interaction needed.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to gain elevated privileges due to improper authentication. This vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to access sensitive information due to an insecure direct object reference. The vulnerability has a medium severity rating with a CVSS score of 5.0. No public exploits or patches are currently documented.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that allows a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. This flaw arises from missing authorization checks, enabling cross-tenant data compromise.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF). This occurs because when service definitions are imported, references to external resources are not properly restricted, enabling the server to access unauthorized resources.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary JavaScript and access sensitive information due to improper input validation. This vulnerability is classified as cross-site scripting (CWE-79) and has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper use of cryptography weakens the encryption protecting stored data. This flaw could allow a local attacker to obtain sensitive information. The vulnerability does not affect integrity or availability and requires local access with low attack complexity and no privileges.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference vulnerability that allows a remote authenticated attacker to obtain sensitive information and cause a denial of service. The vulnerability requires authentication and can lead to high confidentiality impact, limited integrity impact, and limited availability impact.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to bypass restrictions on outbound requests. This could enable the attacker to make the server contact unintended destinations and obtain sensitive information from the responses.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary scripts in another user's browser session by exploiting insufficient validation of certain URL fields.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to improper input validation. The vulnerability has a medium severity with a CVSS score of 4.3. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could obtain sensitive information due to the insertion of sensitive data into log files. This issue allows unauthorized access to sensitive information without impacting system integrity or availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input. This vulnerability is classified as CWE-79 (Cross-Site Scripting). The CVSS v3.1 base score is 5.4, indicating a medium severity level with low complexity attack requiring user interaction and privileges. No patch or remediation information is provided in the available data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker could falsify audit log information. This occurs because the system relies on untrusted client-supplied inputs to record the source of requests, potentially leading to inaccurate audit records.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper validation of user-supplied URLs.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform cross-site scripting (XSS) attacks due to improper neutralization of user-supplied input. This vulnerability could lead to partial confidentiality and integrity impacts but does not affect availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information and cause a denial of service by triggering error messages that disclose sensitive data.