Security Bulletin: IBM API Connect is vulnerable to cross-site scripting (XSS) in Drupal (sa-contrib-2020-025)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details Third Party Entry: 183715 DESCRIPTION: Internationalization module for Drupal cross-site scripting CVSS Base score: 5.4 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183715 fo...

Security Bulletin: IBM API Connect V 2018 (ova) is impacted by weak cryptographic algorithms (CVE-2020-4452)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4452 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5.9 CVSS Temporal...

Security Bulletin: IBM API Connect V2018 (ova) is vulnerable to denial of service (CVE-2020-8551, CVE-2020-8552)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-8551 DESCRIPTION: Kubernetes kubelet API is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request, a remote attacker could exploit th...

CVE-2020-4251

IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175489...

IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2020-33089)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A cross-site scripting vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.8...

IBM API Connect Open Redirect Vulnerability

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in the 'drupalgoto' function in IBM API Connect versions 5.0.0.0...

Security Bulletin: IBM API Connect V5 is impacted by an Open Redirect vulnerability in Drupal core(CVE-2020-13662)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-13662 DESCRIPTION: Drupal Core could allow a remote attacker to conduct phishing attacks, caused by insufficient validation of the destination query parameter in the drupalgoto function. By...

Security Bulletin: IBM API Connect V5 is vulnerable to cross site scripting (XSS) (CVE-2020-4251)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4251 DESCRIPTION: IBM API Connect is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in PHP (CVE-2020-7060, CVE-2020-7059)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-7060 DESCRIPTION: PHP is vulnerable to a buffer overflow, caused by improper bounds checking by the mbflfiltconvbig5wchar function. By sending specially crafted data, a remote attacker could...

IBM API Connect Clickjacking Vulnerability (CNVD-2020-34991)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. A security vulnerability exists in IBM API Connect versions 2018.4.1.0 through 2018.4.1.10. A remo...

CVE-2020-4346

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

CVE-2020-4195

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11254)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-11254 DESCRIPTION: Kubernetes is vulnerable to a denial of service, caused by a flaw in kube-apiserver. By sending a specially-crafted request using YAML payloads, a remote authenticated...

Security Bulletin: IBM API Connect is vulnerable to sensitive information leak (CVE-2020-4346)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4346 DESCRIPTION: IBM API Connect's management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. CVSS Base score: 5.3 CVSS...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in Node.js(CVE-2019-15604, CVE-2019-15605, CVE-2019-15606)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-15604 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit th...

Security Bulletin: IBM API Connect is vulnerable to clickjacking (CVE-2020-4195)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4195 DESCRIPTION: IBM API Connect could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could explo...

Security Bulletin: IBM API Connect is impacted by a vulnerability in NGINX (CVE-2019-20372)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-20372 DESCRIPTION: NGINX could allow a remote attacker to obtain sensitive information, caused by a flaw in certain errorpage configurations. By sending a specially crafted request, a remote...

Security Bulletin: IBM API Connect is vulnerable to vulnerabilities in PHP (CVE-2020-7061, CVE-2020-7062, CVE-2020-7063)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-7061 DESCRIPTION: PHP could allow a remote attacker to obtain sensitive information, caused by an error while extracting PHAR files on Windows using phar extension. An attacker could exploit...

Security Bulletin: IBM API Connect is impacted by multiple vulnerabilities in PHP (CVE-2019-11045, CVE-2019-11044, CVE-2019-11046)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-11045 DESCRIPTION: PHP could allow a remote attacker to bypass security restrictions, caused by an issue when DirectoryIterator class accepts filenames with embedded \0 byte and treats them ...

Security Bulletin: IBM API Connect is impacted by an unspecified vulnerability in Java (CVE-2020-2604)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to take control of the system. CVSS Base score: 8.1 CVSS Temporal Score: See:...