Cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a flaw caused by improper input validation, allowing a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), allowing a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a remote authenticated denial of service attack caused by uncontrolled resource consumption.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving improper validation of user-supplied URLs that allows a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), which may allow a remote attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that allow a remote attacker to gain full administrative control.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that enables a remote authenticated attacker to perform arbitrary file writes.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that may allow a remote attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability. The application relies on client-supplied information to enforce authorization decisions, allowing a remote authenticated attacker to modify tool configurations and cause a denial of service.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows a remote authenticated attacker to modify application API subscriptions.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability during OAuth 2.0 sign-in, which may allow a remote authenticated attacker to have authentication results sent to an attacker-controlled location, potentially leading to account takeover.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to create unauthorized user accounts by forging identity provider data due to insufficient cryptographic signature verification.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information.

IBM API Connect contains a vulnerability that allows a remote authenticated attacker to perform unauthorized data retrieval through improper validation of external references during schema validation.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information and insufficient verification of tenant context.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to bypass destination restrictions and retrieve content from unintended resources.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting vulnerability (CVE-2026-17190) that allows a remote authenticated attacker to execute arbitrary JavaScript due to insufficient sanitization of HTML content supplied by a provider.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability. A remote authenticated attacker may impersonate another party due to insufficient verification of client-supplied information.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference vulnerability that allows remote authenticated attackers to obtain sensitive information and cause a denial of service.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to broken object-level authorization, which may allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows authenticated attackers to access data from other tenants.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to overwrite arbitrary files on the system.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow arbitrary code execution in the management service due to improper control of generation of code.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability that allows a remote attacker to obtain sensitive information and modify API configurations.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper handling of case sensitivity leads to inconsistent application of access controls.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability allowing remote authenticated users to execute arbitrary code via insufficient validation of uploaded content.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an LDAP injection vulnerability that allows authenticated attackers to perform cross-tenant unauthorized administrative access.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that could allow a remote attacker to gain full administrative control.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to remote code execution. A remote authenticated attacker can influence product-generated code via user-supplied values, leading to arbitrary code execution.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery, which may allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a path traversal vulnerability that allows a remote attacker to execute arbitrary code.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to remote SQL injection, allowing authenticated attackers to execute arbitrary SQL commands.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a remote information disclosure flaw caused by improper validation of endpoint URLs.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass vulnerability that allows a remote attacker to obtain sensitive information and take control of gateway configuration.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to an open redirect during sign-in, which may allow a remote attacker to perform an account takeover.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization vulnerability allowing remote authenticated attackers to seize ownership of unauthorized organizations.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability that allows a remote attacker to impersonate a trusted party and access sensitive API catalog and runtime configuration data.

An improper control of object attributes in IBM API Connect allows a remote authenticated attacker to modify system-reserved fields, leading to arbitrary code execution.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a confused deputy flaw that allows a remote authenticated attacker to bypass security restrictions.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery vulnerability that could allow a remote attacker to access internal network resources.

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to improper authentication, which could allow a remote attacker to obtain valid access tokens for other users.