Security Bulletin: Multiple vulnerabilities in Node.js affects IBM API Connect (CVE-2016-7099, CVE-2016-5325)

Summary IBM API Connect is affected by three vulnerabilities in Node.js CVE-2016-7099, CVE-2016-5325 and one for which a CVE ID was not assigned. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2016-7099 DESCRIPTION: Node.js could allow a remote attacker to bypass security...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM API Connect (CVE-2016-5597)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0 that is used by IBM API Connect. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-5597 DESCRIPTION: An...

Security Bulletin: Multiple vulnerabilities affecting web servers that run code in a CGI or CGI-like context affects IBM API Connect (CVE-2016-5385, CVE-2016-1000105)

Summary IBM API Connect is affected by multiple vulnerabilities relating to web servers that run code in a CGI or CGI-like context CVE-2016-5385, CVE-2016-1000105. IBM has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-5385 DESCRIPTION: PHP could allow a remote attacker to...

Security Bulletin: IBM API Connect server credentials used for a specific restricted scenario may have been exposed (CVE-2016-3012)

Summary IBM API Connect server credentials used for a specific restricted scenario that is internal and do not involve authentication may have been exposed and packaged in the toolkit. Vulnerability Details CVEID: CVE-2016-3012 DESCRIPTION: IBM API Connect server credentials used for an internal...

Security Bulletin: Multiple vulnerabilities in NPM affects IBM API Connect (CVE-2016-3956, CVE-2016-2537, CVE-2016-2515)

Summary IBM API Connect is affected by two ReDoS vulnerabilities in modules included in the Node.js npm tool CVE-2016-2537, CVE-2016-2515 and Node.js Package Manager npm Bearer Token Vulnerability CVE-2016-3956. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2016-2515...

Cross site request forgery (csrf)

IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 142430...

CVE-2018-1532

IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 142430...

IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2018-08943)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A cross-site scripting vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.6.5, 5.0.7...

CVE-2018-1430

IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139226...

CVE-2018-1469

IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially crafted HTTP requests. IBM X-Force ID: 140605...

IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2018-03884)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A cross-site scripting vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.6.4, 5.0.7...

CVE-2018-1382

IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138079...

CVE-2017-1785

IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859...

CVE-2017-1785

IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859...

CVE-2017-1555

IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545...

Design/Logic Flaw

IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2017-1551

IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2017-1555

CVE-2017-1555 affects IBM API Connect 5.0.0.0 through 5.0.7.2, where an authenticated user could generate an API token without being subscribed to the application plan. The NVD entry records CVSS v3.0 base score 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). IBM’s security bulletin confirms the vulne...

CVE-2017-1556

IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated attacker to use a regex and cause the system to slow or hang. IBM X-Force ID: 131546...

IBM API Connect and API Management Security Bypass Vulnerability

IBM API Connect and API Management are both products of IBM Corporation in the U.S. IBM API Connect also known as APIConnect is a set of integrated solutions for managing the API lifecycle.API Management is a set of API management platforms from IBM Corporation in the U.S.. A security bypass...