CVE-2020-4825

Summary. CVE-2020-4825 is an IBM API Connect cross-site scripting flaw affecting IBM API Connect 10.0.0.0–10.0.1.0 and 2018.4.1.0–2018.4.1.13. The underlying issue is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript in a trusted session...

CVE-2020-4825

IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

Security Bulletin: IBM API Connect is impacted by insecure web server configuration (CVE-2020-4825)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4825 DESCRIPTION: IBM API Connect is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...

IBM API Connect Cross-Site Request Forgery Vulnerability (CNVD-2021-09301)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. IBM API Connect suffers from a cross-site request forgery vulnerability, which arises from a WEB...

IBM API Connect 跨站脚本漏洞

IBM API Connect is a comprehensive end-to-end API lifecycle solution. A cross-site scripting vulnerability exists in IBM API Connect 10.0.0.0 - 10.0.1.0, 2018.4.1.0 - 2018.4.1.13. An attacker can exploit the vulnerability to embed arbitrary JavaScript code in the web UI that can alter the intende...

Security Bulletin: IBM API Connect is vulnerable to cross-site request forgery (CVE-2020-4826)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4826 DESCRIPTION: IBM API Connect is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the websi...

Security Bulletin: IBM API Connect's Developer Portal is vulnerable to arbitrary code excution in Drupal Core (CVE-2020-13671)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13671 DESCRIPTION: Drupal Core could allow a remote attacker to execute arbitrary code on the system, caused by the failure to properly sanitize certain filenames on uploaded files. By...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Java SE (CVE-2020-14782)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact,...

Security Bulletin: IBM API Connect is vulnerable to web cache poisoning (CVE-2020-4828)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4828 DESCRIPTION: IBM API Connect is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. CVSS Base score: 6.5 CVSS Temporal Score: See:...

Security Bulletin: IBM API Connect is vulnerable to cross-site request forgery (CSRF) (CVE-2020-4827)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4827 DESCRIPTION: IBM API Connect is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the websi...

Security Bulletin: IBM API Connect is impacted by multiple vulnerabilities in Node.js.(CVE-2020-8201 CVE-2020-8251 CVE-2020-8252 )

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this...

Security Bulletin: IBM API Connect's Developer Portal is impacted by multiple vulnerabilities in Drupal core.

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13669 DESCRIPTION: Drupal core is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the built-in CKEditor image caption functionality. A remote...

Security Bulletin: IBM API Connect is vulnerable to denial of service (DoS) via etcd (CVE-2020-15106 CVE-2020-15112 CVE-2020-15113)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-15106 DESCRIPTION: etcd is vulnerable to a denial of service, caused by improper data validation in the decodeRecord method. By sending a specially crafted data, a remote authenticated attacke...

Security Bulletin: IBM API Connect is vulnerable to sensitive information leak (CVE-2020-4640)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4640 DESCRIPTION: Certain IBM API Connect configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like prox...

Security Bulletin: API Connect is impacted by a denial of service (DoS) vulnerability in Node.js (CVE-2020-11080)

Summary IBM API Connect has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-11080 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which is limited to 32 settings by default. By sending overly large HTTP/2 SETTIN...

IBM API Connect 跨站请求伪造漏洞

IBM API Connect is a comprehensive end-to-end API lifecycle solution. A cross-site request forgery vulnerability exists in IBM API Connect 10.0.0.0 - 10.0.1.0, 2018.4.1.0 - 2018.4.1.13. An attacker can exploit this vulnerability to perform malicious and unauthorized actions transmitted from a use...

Security Bulletin: IBM API Connect V5 Developer Portal is vulnerable to cross-site scripting (CVE-2020-4838)

Summary IBM API Connect has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-4838 DESCRIPTION: IBM API Connect is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended...

IBM API Connect Cross-Site Scripting Execution Vulnerability

IBM API Connect is an integrated API management product service where you can perform all the steps in the API lifecycle as well as actions throughout the API lifecycle. A cross-site script execution vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.10. An attacker could...

CVE-2020-4838

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2020-4838

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...