Vulnerabilities > IBM > API Connect > 5.0.8.2

DATE CVE VULNERABILITY TITLE RISK
2018-12-20 CVE-2018-1973 Improper Privilege Management vulnerability in IBM API Connect
IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality.
network
low complexity
ibm CWE-269
7.2
2018-12-20 CVE-2018-1784 Unspecified vulnerability in IBM API Connect
IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework.
network
low complexity
ibm
critical
9.8
2018-12-20 CVE-2018-1778 Improper Authentication vulnerability in IBM API Connect
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other user’s data / access to their privileges (if the user happens to be an Admin for example).
network
high complexity
ibm CWE-287
8.1
2018-11-09 CVE-2018-1774 Improper Neutralization of Formula Elements in a CSV File vulnerability in IBM API Connect
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator.
local
low complexity
ibm CWE-1236
7.8
2018-08-22 CVE-2018-1599 Improper Input Validation vulnerability in IBM API Connect
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim.
network
low complexity
ibm CWE-20
5.4
2018-08-16 CVE-2018-1712 Cross-Site Request Forgery (CSRF) vulnerability in IBM API Connect
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery.
network
low complexity
ibm CWE-352
critical
9.9
2018-07-31 CVE-2018-1638 Improper Authentication vulnerability in IBM API Connect
IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios.
network
high complexity
ibm CWE-287
8.1
2018-05-31 CVE-2018-1532 Information Exposure vulnerability in IBM API Connect
IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system.
network
low complexity
ibm CWE-200
4.3
2018-05-02 CVE-2018-1468 Information Exposure vulnerability in IBM API Connect 5.0.8.1/5.0.8.2
IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized.
network
low complexity
ibm CWE-200
4.3
2018-04-30 CVE-2018-1430 Cross-site Scripting vulnerability in IBM API Connect
IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting.
network
low complexity
ibm CWE-79
5.4