797 matches found
Security Bulletin: IBM API Connect's Developer Portal is impacted by vulnerabilities in OpenSSL (CVE-2019-1559)
Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length...
Security Bulletin: IBM API Connect's Developer Portal is impacted by a path traversal vulnerability (CVE-2019-4460)
Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4460 DESCRIPTION: IBM API Connect developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot...
Security Bulletin: API Connect is impacted by an information leakage vulnerability in Oracle MySQL (CVE-2018-3123)
Summary API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-3123 DESCRIPTION: An unspecified vulnerability in Oracle MySQL related to the Server Server: libmysqld component could allow an unauthenticated attacker to obtain sensitive information resulting i...
Security Bulletin: IBM API Connect Developer Portal is impacted by multiple PHP vulnerabilities(CVE-2019-11038 CVE-2019-11039 CVE-2019-11040)
Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-11038 DESCRIPTION: PHP could allow a remote attacker to obtain sensitive information, caused by an uninitialized read in the gdImageCreateFromXbm function. By sending a specially-crafted...
CVE-2018-2011
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...
CVE-2019-4382
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...
CVE-2018-1858
IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256...
CVE-2019-4382
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...
CVE-2018-2011
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...
CVE-2018-1858
IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256...
CVE-2018-2013
IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IBM X-Force ID: 155193...
Design/Logic Flaw
IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IBM X-Force ID: 155193...
Design/Logic Flaw
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...
Cross site request forgery (csrf)
IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256...
Code injection
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...
CVE-2019-4382
IBM API Connect 5.0.0.0–5.0.8.6 contains an information-disclosure vulnerability (CVE-2019-4382) that could allow an unauthenticated user to obtain sensitive information about system users via specially crafted HTTP requests. The issue affects the LoopBack component and is rated with CVSSv3 base ...
CVE-2018-2013
CVE-2018-2013 affects IBM API Connect 2018.1–2018.4.1.5, where an information disclosure vulnerability could allow an unauthorized user to obtain sensitive data and aid further attacks. The CVSS base score is 5.3 (3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) per IBM/X-Force data, with NVD citing a ne...
CVE-2018-1858
IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256...
CVE-2018-2011
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...
CVE-2018-1858
IBM API Connect 5.0.0.0–5.0.8.6 is affected by CVE-2018-1858, a cross-site request forgery that could allow an attacker to perform malicious, unauthorized actions transmitted from a trusted user. The remediation, per IBM, is to upgrade to V5.0.8.6 iFix 2 (5.0.8.6 iFix 2). Public CVSS scores vary ...