← Back

Api Connect

api_connect

Vendor: Ibm • 81 CVEs

CVEs (81)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-2015
1Ibm
1Api Connect
Nov 21, 2024
May 2, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to...Show more
IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 155195.Show less
CVE-2018-2007
1Ibm
1Api Connect
Nov 21, 2024
Apr 29, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 155078.
CVE-2019-4203
1Ibm
1Api Connect
Jun 17, 2026
Apr 15, 2019
N/A· v4
9.8 CRITICAL· v3
9.0 HIGH· v2
IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124.
CVE-2019-4202
1Ibm
1Api Connect
Jun 17, 2026
Apr 15, 2019
N/A· v4
10.0 CRITICAL· v3
10.0 HIGH· v2
IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-For...Show more
IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123.Show less
CVE-2019-4155
1Ibm
1Api Connect
Jun 17, 2026
Apr 8, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (OIDC) user registry. IBM X-Force ID: 158544.
CVE-2019-4051
1Ibm
1Api Connect
Jun 17, 2026
Apr 8, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use...Show more
Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with their mac addresses. An attacker can use this information in targeted attacks. IBM X-Force ID: 156542.Show less
CVE-2018-1874
1Ibm
1Api Connect
Nov 21, 2024
Apr 2, 2019
N/A· v4
4.6 MEDIUM· v3
2.1 LOW· v2
IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. IBM X-Force ID: 151636.
CVE-2019-4052
1Ibm
1Api Connect
Jun 17, 2026
Mar 22, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2018-2009
1Ibm
1Api Connect
Nov 21, 2024
Mar 11, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc....Show more
IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc. IBM X-Force ID: 155148.Show less
CVE-2019-4008
1Ibm
1Api Connect
Jun 17, 2026
Feb 7, 2019
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155626.
CVE-2018-1976
1Ibm
1Api Connect
Nov 21, 2024
Jan 29, 2019
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031...Show more
IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.Show less
CVE-2018-1932
1Ibm
1Api Connect
Nov 21, 2024
Jan 8, 2019
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force...Show more
IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.Show less
CVE-2018-1859
1Ibm
1Api Connect
Nov 21, 2024
Jan 4, 2019
N/A· v4
4.7 MEDIUM· v3
6.5 MEDIUM· v2
IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges. IBM X-Force ID: 151258.
CVE-2018-1973
1Ibm
1Api Connect
Nov 21, 2024
Dec 20, 2018
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality. IBM X-Force ID: 153914.
CVE-2018-1784
1Ibm
1Api Connect
Nov 21, 2024
Dec 20, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. IBM X-Force ID: 148807.
CVE-2018-1778
1Ibm
1Api Connect
Nov 21, 2024
Dec 20, 2018
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an Acce...Show more
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other user’s data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.Show less
CVE-2018-1779
1Ibm
1Api Connect
Nov 21, 2024
Nov 20, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size. IBM X-Force ID: 148802.
CVE-2018-1774
1Ibm
1Api Connect
Nov 21, 2024
Nov 9, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IB...Show more
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.Show less
CVE-2018-1789
1Ibm
1Api Connect
Nov 21, 2024
Sep 7, 2018
N/A· v4
9.9 CRITICAL· v3
6.5 MEDIUM· v2
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
CVE-2016-1000232
3Ibm
RedhatSalesforce
3Api Connect
Openshift Container PlatformTough Cookie
Nov 21, 2024
Sep 5, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP heade...Show more
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.Show less