Filtered by vendor Ibm Subscriptions
Total 9872 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-17352 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17334 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
CVE-2026-17330 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17325 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17304 1 Ibm 1 Api Connect 2026-11-10 6.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.
CVE-2026-17188 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.
CVE-2026-17187 1 Ibm 1 Api Connect 2026-11-10 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17154 1 Ibm 1 Api Connect 2026-11-10 5.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CVE-2026-105459 1 Ibm 1 Api Connect 2026-11-10 6.8 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.
CVE-2026-16679 1 Ibm 1 Api Connect 2026-11-10 4.3 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CVE-2026-16709 1 Ibm 1 Api Connect 2026-11-10 8.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.
CVE-2026-16710 1 Ibm 1 Api Connect 2026-11-10 5.8 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
CVE-2026-16711 1 Ibm 1 Api Connect 2026-11-10 5.3 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.
CVE-2026-16712 1 Ibm 1 Api Connect 2026-11-10 7.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.
CVE-2026-16714 1 Ibm 1 Api Connect 2026-11-10 7.5 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability.
CVE-2026-16715 1 Ibm 1 Api Connect 2026-11-10 7.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CVE-2026-16716 1 Ibm 1 Api Connect 2026-11-10 8.8 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
CVE-2026-16717 1 Ibm 1 Api Connect 2026-11-10 7.7 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-16718 1 Ibm 1 Api Connect 2026-11-10 7.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
CVE-2026-17362 1 Ibm 1 Api Connect 2026-11-10 9.8 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.