547 matches found
Security Bulletin: IBM API Connect is affected by multiple vulnerabilities in Drupal (CVE-2018-7603)
Summary API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-7603 DESCRIPTION: The Search Autocomplete for Drupal is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerabili...
Security Bulletin: IBM API Connect is affected by Foreshadow Spectre Variant vulnerability (CVE-2018-3646 CVE-2018-3615 CVE-2018-3620)
Summary API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-3646 DESCRIPTION: Multiple Intel CPU's could allow a local attacker to obtain sensitive information, caused by a flaw in the CPU speculative branch instruction execution feature. By conducting...
Security Bulletin: IBM API Connect is affected by OpenSSL vulnerabilities (CVE-2018-0732 CVE-2018-12115 CVE-2018-7166 CVE-2018-0737)
Summary IBM API Management has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TLS...
IBM API Connect Server-Side Request Forgery Vulnerability
IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. A server-side request forgery vulnerability exists in IBM API Connect versions 2018.1.0 through...
Server side request forgery (ssrf)
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939...
CVE-2018-1789: Server-Side Request Forgery (SSRF)
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939...
Security Bulletin: IBM API Connect is affected by a clickjacking vulnerability (CVE-2018-1599)
Summary IBM API Connect has addressed the following vulnerability. API Connect could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious website, a remote attacker could exploit this vulnerability to hijack the victim's click actions an...
Security Bulletin: IBM API Connect is impacted by a Drupal 8 vulnerability (CVE-2018-14773)
Summary IBM API Connect has fixed the following vulnerability. API Connect is impacted by vulnerabilities addressed in the Drupal 8 advisory https://www.drupal.org/SA-CORE-2018-005 Vulnerability Details CVEID: CVE-2018-14773 DESCRIPTION: Drupal Core could allow a remote attacker to bypass securit...
CVE-2018-1599
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...
CVE-2018-1599
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...
CVE-2018-1599: Improper Input Validation
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...
CVE-2018-1712
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370...
CVE-2018-1712: Cross-Site Request Forgery (CSRF)
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370...
Security Bulletin: IBM API Connect is vulnerable to denial of service attacks via https-proxy-agent/[email protected] (CVE-2018-3739)
Summary IBM API Connect has addressed the following vulnerability. Node.js https-proxy-agent module is vulnerable to a denial of service, caused by passing the auth option to the Buffer constructor without proper sanitization. A remote attacker could exploit this vulnerability using the auth...
IBM API Connect Developer Portal Privilege Gain Vulnerability
IBM API Connect aka APIConnect is a set of integrated solutions for managing the API lifecycle from IBM in the United States. The solution supports creating, running, managing and protecting APIs and microservices, etc. Developer Portal is one of the developer portals. A privilege acquisition...
Security Bulletin: API Connect Developer Portal is affected by multiple PHP vulnerabilities
Summary IBM API Connect has addressed the following vulnerabilities. Several security issues were fixed in PHP's HTML-embedded scripting language interpreter. Vulnerability Details CVEID: CVE-2018-10549 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused...
CVE-2018-1638
IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...
CVE-2018-1638: Improper Authentication
IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...
Security Bulletin: API Connect is affected by a weak two factor authentication vulnerability
Summary IBM API Connect has addressed the following vulnerability. API Connect user are affected by a TwoFactor 2FA/TFA bypass while resetting password. Using API Connect version 5.0.8.3 and with Two Factor Authentication enabled on the Developer Portal it is possible to bypass TFA and get full...
IBM API Connect Information Disclosure Vulnerability
IBM API Connect is a comprehensive end-to-end API lifecycle solution. An information disclosure vulnerability exists in IBM API Connect 2018.1.0.0, 2018.2.1, 2018.2.2, 2018.2.3, and 2018.2.4. An attacker can exploit the vulnerability to obtain sensitive information...