IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This occurs due to insufficient validation of uploaded content, enabling malicious code execution on the server.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to induce the affected component to send requests to unintended destinations and retrieve the responses, potentially exposing sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. This vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability due to improper handling of case sensitivity. This flaw allows a remote attacker to bypass access controls inconsistently applied to different case variations of requests, enabling unauthorized administrative operations and access to sensitive information.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have vulnerabilities to Regular Expression Denial of Service (ReDoS) attacks and improper neutralization of wildcard query operators. These flaws can lead to denial of service and potentially impact confidentiality. The vulnerabilities have a high CVSS score of 9.6, indicating critical severity. No patch or remediation information is provided in the available data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 9.6, indicating critical impact on confidentiality and integrity without affecting availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to modify object attributes improperly. This flaw enables an attacker to change access-related settings that should be system-controlled, potentially exposing sensitive information. The vulnerability is identified as CWE-915 and carries a critical severity with a CVSS score of 9.6.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of hard-coded credentials. This flaw could allow a remote attacker to gain full administrative control over the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an LDAP injection vulnerability. This flaw allows a remote authenticated attacker to manipulate directory queries by injecting malicious input, potentially gaining unauthorized administrative access to other tenants within the system.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. The issue arises from improper control over code generation influenced by user-supplied input, potentially leading to critical system compromise.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands. This is due to improper neutralization of special elements in SQL commands, leading to SQL injection. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF). This flaw can lead to unauthorized access to sensitive information and bypass of security restrictions. The vulnerability has a high severity with a CVSS score of 9.6, indicating critical impact on confidentiality and integrity without affecting availability.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote authenticated attacker to perform arbitrary file writes. This flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote authenticated attacker to access or delete resources belonging to other tenants. This vulnerability arises from improper validation of file paths, enabling unauthorized cross-tenant resource manipulation.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to obtain sensitive information. The vulnerability exists because an unauthenticated service can be induced to send requests to unintended destinations, potentially exposing confidential data.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This flaw can lead to unauthorized data disclosure with high impact on confidentiality, integrity, and availability.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper control in the generation of code within the affected versions. The vulnerability has a critical severity with a CVSS score of 9.9.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to execute arbitrary code. This vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability if exploited.
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs. This flaw could lead to a critical impact on confidentiality without requiring user interaction or privileges.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform server-side request forgery (SSRF) and obtain sensitive information. This vulnerability is identified as CVE-2026-17298 and has a critical severity rating with a CVSS score of 9.9.