API Connect (12.1.0.0-12.1.1.2)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that allow a remote attacker to gain full administrative control.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that enables a remote authenticated attacker to perform arbitrary file writes.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability allowing remote authenticated users to execute arbitrary code via insufficient validation of uploaded content.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.