IBM API Connect vulnerabilities
6 known CVE vulnerabilities in IBM API Connect, translated and rated.
- CVE-2017-1322High
IBM API Connect version 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2017-1379High
IBM API Connect version 5.0.0.0 could allow a remote attacker to obtain sensitive information due to improper handling of requests to the Developer Portal.
- CVE-2017-1161High
IBM API Connect version 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. An attacker could exploit this vulnerability by crafting a malicious URL.
- CVE-2026-9074Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.
- CVE-2025-13915Critical
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
- CVE-2026-3144High
IBM API Connect versions 12.1.0.0 through 12.1.0.3 use default credentials, which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.