CVE-2019-4202

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123...

CVE-2019-4203

The CVE-2019-4203 issue affects IBM API Connect Developer Portal (versions 5.0.0.0–5.0.8.6). The root cause allows app developers to download arbitrary files from the host OS and may enable SSRF attacks. Impact is described as potential exposure of files with high integrity/availability concerns....

PT-2019-16962 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery SSRF attacks. SS...

CVE-2019-4203: Server-Side Request Forgery (SSRF)

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124...

CVE-2019-4202: Improper Neutralization of Special Elements used in an OS Command

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123...

Command Execution Vulnerability in IBM API Connect

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A command injection vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.6,...

Security Bulletin: IBM API Connect's Developer Portal(V5) is impacted by a critical local file Inclusion vulnerability (CVE-2019-4203)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4203 DESCRIPTION: IBM API Connect Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. CVSS Base Score: 8.9...

Security Bulletin: IBM API Connect's Developer Portal(V5) is vulnerable to command injection (CVE-2019-4202)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4202 DESCRIPTION: IBM API Connect's Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete...

Security Bulletin: IBM API Connect Developer Portal is impacted by Cross Site Scripting(XSS) in Drupal core (CVE-2019-6341)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: Not Applicable DESCRIPTION: AddToAny Share Buttons Module for Drupal is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could...

CVE-2019-4155

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

CVE-2019-4051

Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542...

CVE-2019-4051

Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542...

CVE-2019-4155

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

Information disclosure

Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542...

Privilege escalation

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

CVE-2019-4051

Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542...

CVE-2019-4155

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

CVE-2019-4051

CVE-2019-4051 affects IBM API Connect 2018.1–2018.4.1.3, where certain URIs disclose system-specification details such as machine id, system UUID, filesystem paths, network interface names and MAC addresses. This information disclosure could enable targeted attacks. The IBM bulletin confirms reme...

CVE-2019-4155

CVE-2019-4155 affects IBM API Connect’s Developer Portal (versions 2018.1–2018.4.1.3). The privilege escalation vulnerability arises when the portal is integrated with an OpenID Connect (OIDC) user registry. IBM’s security bulletin confirms the issue and lists the affected VRMF: 2018.1–2018.4.1.3...

PT-2019-16864

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 2018.1 through 2018.4.1.3 Description The issue allows certain URIs to disclose system specification information, including machine id, system uuid, filesystem paths, network interface names, and their mac addresses...