AC
Product
API Connect
81
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 14High 22Medium 44Low 1
Watch
Add API Connect to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-28522 | 8.8 | May 12 | IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to Affected: 10.0.0.0 before 10.0.1.11; 10.0.2.0 before 10.0.5.2 |
| CVE-2018-1858 | 8.8 | Jun 25 | IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a… Affected: 5.0.0.0 through 5.0.8.6 |
| CVE-2017-1322 | 8.2 | Jun 27 | IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 5.0.0.0; 5.0.0.1; 5.0.1.0; 5.0.2.0; 5.0.3.0; 5.0.4.0; +5 more |
| CVE-2018-1778 | 8.1 | Dec 20 | IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is… Affected: 5.0.8.0 through 5.0.8.4; 2018.1.0 through 2018.4.1.0 |
| CVE-2018-1638 | 8.1 | Jul 31 | IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios Affected: 5.0.0.0 through 5.0.8.3 |
| CVE-2018-1774 | 7.8 | Nov 9 | IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be… Affected: 5.0.0.0 through 5.0.8.4; 2018.1.0 through 2018.3.6 |
| CVE-2022-34350 | 7.5 | Feb 8 | IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack, caused by improper… Affected: 10.0.0.0 through 10.0.5.0; 10.0.1.0 through 10.0.1.7; 2018.4.1.0 through 2018.4.1.20 |
| CVE-2020-4695 | 7.5 | Mar 8 | IBM API Connect V10 is impacted by insecure communications during database replication Affected: 10.0.0.0 through 10.0.1.0 |
| CVE-2020-4452 | 7.5 | Jun 29 | IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2018.4.1.0 through 2018.4.1.11 |
| CVE-2019-4553 | 7.5 | Mar 24 | IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 5.0.0.0 through 5.0.8.73 |
| CVE-2019-4609 | 7.5 | Dec 18 | IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2018.4.1.7 |
| CVE-2019-4460 | 7.5 | Aug 20 | IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system Affected: 5.0.0.0 through 5.0.8.6 |
| CVE-2019-4402 | 7.5 | Aug 20 | IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API Affected: 2018.1.0 through 2018.4.1.6 |
| CVE-2019-4256 | 7.5 | May 29 | IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 5.0.0.0 through 5.0.8.6 |
| CVE-2018-2007 | 7.5 | Apr 29 | IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2018.1.0 through 2018.4.1.2 |
| CVE-2019-4052 | 7.5 | Mar 22 | IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users Affected: 2018.1; 2018.4.1.2 |
| CVE-2018-1779 | 7.5 | Nov 20 | IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size Affected: 2018.1.0 through 2018.3.7 |
| CVE-2017-1379 | 7.5 | Jun 15 | IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal Affected: 5.0.0.0; 5.0.0.1; 5.0.1.0; 5.0.2.0; 5.0.3.0; 5.0.4.0; +6 more |
| CVE-2016-3012 | 7.5 | Dec 1 | IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to… Affected: through 5.0.2.0 |
| CVE-2017-1161 | 7.3 | Apr 17 | IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal Affected: 5.0.6.0 |
| CVE-2020-4638 | 7.2 | Sep 3 | IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation Affected: 2018.4.1.0 through 2018.4.1.12 |
| CVE-2018-1973 | 7.2 | Dec 20 | IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members… Affected: 5.0.0.0 through 5.0.8.4 |
Showing 22