IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The flaw arises from improper authorization controls within the affected versions.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote authenticated attacker to access sensitive information. The vulnerability requires authentication and does not allow code execution but can lead to information disclosure.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain information about internal network services. This occurs due to improper validation of user-supplied URLs, enabling the server to be induced to contact internal systems. The vulnerability has a medium severity rating with a CVSS score of 6.4.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries. This occurs due to insufficient validation of request parameters, enabling circumvention of analytics data restrictions.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization flaw that could allow a remote authenticated attacker to access sensitive information. The vulnerability arises because authorization checks are not enforced when resolving certain organization URLs, potentially exposing data belonging to other organizations.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by triggering uncontrolled resource consumption. Certain crafted requests can cause internal processing to stall, potentially making the service unavailable.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a vulnerability where verbose error messages disclose sensitive system information. This could aid a remote authenticated attacker in gathering details about the environment. The vulnerability is rated medium severity with a CVSS score of 4.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to bypass security restrictions due to inconsistent application of authentication checks. This flaw enables access to protected resources without valid credentials.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where insufficient validation of path parameters allows a remote authenticated attacker to access sensitive information belonging to other tenants.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass destination restrictions on outbound requests. This server-side request forgery (SSRF) flaw could enable the attacker to retrieve sensitive information from unintended resources.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to gain unauthorized access to sensitive API catalog and runtime configuration data. This occurs due to improper authentication where client-supplied information is insufficiently verified, enabling an attacker to impersonate a trusted party.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary JavaScript in the context of the user's browser because HTML content supplied by a provider is not properly sanitized before display.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to enumerate usernames by observing differences in response behavior. This issue could disclose valid usernames but does not impact confidentiality, integrity, or availability beyond that.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where a remote authenticated attacker can bypass security restrictions due to improper handling of case sensitivity. This inconsistency allows unauthorized emails to be sent by circumventing access controls.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability has a high severity with a CVSS score of 8.5. No public exploits or patches are currently documented.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access sensitive information of other tenants due to broken object-level authorization. This flaw impacts confidentiality but does not affect integrity or availability. The vulnerability has a high severity with a CVSS score of 7.7.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input. This vulnerability has a medium severity score of 4.3 and does not impact confidentiality or availability but can affect integrity. No official patch or remediation information is provided.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants. This is due to insufficient input validation of uploaded custom module content, which can be processed with privileges beyond the attacker's own tenant.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to obtain sensitive information due to verbose error messages. This information disclosure vulnerability has a medium severity rating with a CVSS score of 5.3.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This occurs due to improper control over code generation influenced by user-supplied input. The vulnerability has a low CVSS score of 3.3 and requires high attack complexity and privileges with no user interaction needed.