IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions. This occurs due to improper authentication where client-supplied information is not sufficiently verified, enabling impersonation of another party.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions. This vulnerability is critical with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper control over modification of object attributes, enabling a user to set fields that should be system-controlled, potentially leading to code execution.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to access internal network resources. The vulnerability has a medium severity with a CVSS score of 5.5.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This is due to improper neutralization of special elements in SQL commands, leading to SQL injection. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML External Entity (XXE) injection that could allow a remote attacker to obtain sensitive information. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy flaw. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability has a high severity with a CVSS score of 8.5.
The Redux Framework plugin for WordPress up to version 4.5.16 contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to export the entire Redux options panel configuration, including sensitive data such as API keys and credentials. Exploitation requires a theme or plugin to register a Redux import_export field on a user profile, exposing a nonce in the subscriber's profile page source, which can be read without additional privileges.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions. This is due to improper restriction of security token assignment, enabling unauthorized access and modification of sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to access sensitive information. The vulnerability requires authentication and does not allow denial of service but can lead to confidentiality breaches.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper validation of file paths.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability that allows remote attackers to obtain valid access tokens for other users. This occurs because authentication against a connected directory service is not sufficiently enforced, enabling attackers to assume another user's identity.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass authorization controls using user-controlled keys. This flaw enables the attacker to obtain sensitive information and modify arbitrary documents within the affected system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to overwrite arbitrary files. This vulnerability has a high severity rating with a CVSS score of 7.5, indicating significant potential impact on confidentiality, integrity, and availability. The vulnerability requires network access with high attack complexity and no privileges, but user interaction is required for exploitation.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow a remote attacker to access internal network resources. This vulnerability has a high severity score of 9.3 and impacts confidentiality and integrity of the system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to modify internal requests by injecting additional parameters. This occurs due to improper neutralization of argument delimiters in user-supplied input, leading to unsafe handling of special characters.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw affects confidentiality but does not impact integrity or availability. The vulnerability has a high severity rating with a CVSS score of 7.7.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an injection vulnerability that allows a remote authenticated attacker to access sensitive information belonging to other tenants. The flaw arises because input used to build data queries is not properly sanitized, enabling unauthorized data retrieval.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker with limited privileges to view arbitrary files on the system by sending a specially crafted URL request. This vulnerability does not require user interaction and impacts confidentiality without affecting integrity or availability.