PT-2020-12757

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to perform open redirect attacks due to insecure handling of 404 requests. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, update...

PT-2020-12756

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information due to insecure request handling. Recommendations For CA API...

PT-2020-12752

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to bypass authorization due to the insecure handling of shared secret keys. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, updat...

PT-2020-12754

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue is related to an access control flaw that allows privileged users to view restricted sensitive information. Recommendations For CA API Developer Portal versions 4.3.1 and...

PT-2020-12760

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue is related to an access control flaw that allows malicious users to elevate privileges. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, update to ...

PT-2020-12759

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to perform open redirect attacks due to insecure handling of loginRedirect page redirects. Recommendations For CA API Developer Portal versions 4.3.1 and...

PT-2020-12755

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue is related to an access control flaw that allows privileged users to view and edit user data. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, upda...

PT-2020-12758

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to perform open redirect attacks due to the insecure handling of homeRedirect page redirects. Recommendations For CA API Developer Portal versions 4.3.1...

CVE-2020-11660: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view restricted sensitive information...

CVE-2020-11659: Authorization Bypass Through User-Controlled Key

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action...

CVE-2020-11658: Authorization Bypass Through User-Controlled Key

CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization...

CVE-2020-11663: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks...

CVE-2020-11662: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information...

CVE-2020-11661: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

CVE-2020-11666: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges...

CVE-2020-11665: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks...

CVE-2020-11664: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks...

Security Bulletin: API Connect V2018 is impacted by a information disclosure vulnerability (CVE-2019-4437)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4437 DESCRIPTION: IBM API Connect Developer Portal may inadvertently leak sensitive details about internal servers and network via API swagger. CVSS Base Score: 8.2 CVSS Temporal Score: See fo...

Security Bulletin: IBM API Connect's Developer Portal is impacted by a denial of service vulnerability in MySQL (CVE-2019-2805)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-2805 DESCRIPTION: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Parser. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0....

Security Bulletin: API Connect's Developer Portal is impacted by vulnerabilities in PHP

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-11035 DESCRIPTION: PHP could allow a remote attacker to obtain sensitive information, caused by heap-based buffer overflow in the exifiifaddvalue function in the EXIF extension. By persuading ...