IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2020-33089)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A cross-site scripting vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.8...

IBM API Connect Open Redirect Vulnerability

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in the 'drupalgoto' function in IBM API Connect versions 5.0.0.0...

PT-2020-17947

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.8 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...

Security Bulletin: IBM API Connect V5 is impacted by an Open Redirect vulnerability in Drupal core(CVE-2020-13662)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13662 DESCRIPTION: Drupal Core could allow a remote attacker to conduct phishing attacks, caused by insufficient validation of the destination query parameter in the drupalgoto function. By...

Security Bulletin: IBM API Connect V5 is vulnerable to cross site scripting (XSS) (CVE-2020-4251)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4251 DESCRIPTION: IBM API Connect is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in PHP (CVE-2020-7060, CVE-2020-7059)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-7060 DESCRIPTION: PHP is vulnerable to a buffer overflow, caused by improper bounds checking by the mbflfiltconvbig5wchar function. By sending specially crafted data, a remote attacker could...

IBM API Connect Clickjacking Vulnerability (CNVD-2020-34991)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. A security vulnerability exists in IBM API Connect versions 2018.4.1.0 through 2018.4.1.10. A remo...

CVE-2020-4195

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-4346

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

CVE-2020-4346

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

Code injection

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

Design/Logic Flaw

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-4195

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-4346

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

CVE-2020-4346

CVE-2020-4346 affects IBM API Connect: management server with versions 2018.4.1.0–2018.4.1.10 contains an unsecured API that allows an unauthenticated attacker to obtain sensitive information. The issue is documented by IBM and is associated with a CVSS ~5.3 (medium) overall impact, reflecting in...

CVE-2020-4195

CVE-2020-4195 affects IBM API Connect: API Connect V2018.4.1.0–2018.4.1.10 vulnerable to clickjacking via a malicious website, enabling a remote actor to hijack the user’s click actions. The IBM security bulletin confirms remediation in V2018.4.1.11 (addressed) and provides the upgrade path (2018...

PT-2020-18015

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 2018.4.1.0 through 2018.4.1.10 Description The management server of IBM API Connect has an unsecured API that can be exploited by an unauthenticated attacker to obtain sensitive information. Recommendations For version...

CVE-2020-4195: Improper Restriction of Rendered UI Layers or Frames

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-4346: Undefined Security Weakness

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

PT-2020-17910

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 2018.4.1.0 through 2018.4.1.10 Description The issue allows a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this to...