Ibm: >> Api Connect Security Vulnerabilities
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
CVSS Score
5.4
EPSS Score
0.003
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
CVSS Score
7.6
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVSS Score
9.3
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVSS Score
9.9
EPSS Score
0.006
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVSS Score
9.9
EPSS Score
0.005
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
CVSS Score
4.0
EPSS Score
0.001
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.
CVSS Score
7.7
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
CVSS Score
5.4
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
CVSS Score
9.9
EPSS Score
0.008
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
CVSS Score
6.8
EPSS Score
0.005
Published
2026-11-07