CVSS: 5.9EPSS: 0%CPEs: 23EXPL: 0CVE-2017-1386
https://notcve.org/view.php?id=CVE-2017-1386
IBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man in the middle techniques. IBM X-Force ID: 127160. IBM API Connect versión 5.0.0.0, podría permitir a un usuario omitir las restricciones de la política y crear contraseñas no conformes que podrían ser interceptadas y descifradas utilizando técnicas de tipo man in the middle. ID de IBM X-Force: 127160. • http://www.ibm.com/support/docview.wss?uid=swg22004981 http://www.securityfocus.com/bid/100008 https://exchange.xforce.ibmcloud.com/vulnerabilities/127160 • CWE-521: Weak Password Requirements •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-0149
https://notcve.org/view.php?id=CVE-2015-0149
The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls. El portal Developer en IBM API Management 3.0 anterior a 3.0.4.1 no restringe correctamente el acceso a las APIs públicas y privadas, lo que permite a usuarios remotos autenticados obtener información sensible o modificar datos a través de llamadas a APIs no especificadas. • http://www-01.ibm.com/support/docview.wss?uid=swg1LI78430 http://www-01.ibm.com/support/docview.wss?uid=swg21696693 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2014-6172
https://notcve.org/view.php?id=CVE-2014-6172
IBM API Management 3.0 before 3.0.4.0 IF1 allows remote attackers to obtain sensitive analytics information in an encrypted form via unspecified vectors. IBM API Management 3.0 anterior a 3.0.4.0 IF1 permite a atacantes remotos obtener información sensible de analíticas de manera cifrada a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1LI78291 http://www-01.ibm.com/support/docview.wss?uid=swg21694460 http://www.securitytracker.com/id/1031613 https://exchange.xforce.ibmcloud.com/vulnerabilities/98417 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-6133
https://notcve.org/view.php?id=CVE-2014-6133
IBM API Management 3.x before 3.0.1.0 allows local users to obtain sensitive ciphertext information via unspecified vectors. IBM API Management 3.x anterior a 3.0.1.0 permite a usuarios locales obtener información sensible de texto de cifrado a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1LI78229 http://www-01.ibm.com/support/docview.wss?uid=swg21686801 https://exchange.xforce.ibmcloud.com/vulnerabilities/96813 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3036
https://notcve.org/view.php?id=CVE-2014-3036
Unspecified vulnerability in IBM API Management 3.0.0.0, when basic authentication is used for APIs, allows remote attackers to bypass intended restrictions on topology access, and obtain sensitive information, via unknown vectors. Vulnerabilidad no especificada en IBM API Management 3.0.0.0, cuando autenticación básica está utilizada para APIs, permite a atacantes remotos evadir restricciones de acceso a topología, y obtener información sensible, a través de vectores desconocidos. • http://secunia.com/advisories/59044 http://www-01.ibm.com/support/docview.wss?uid=swg1LI78000 http://www-01.ibm.com/support/docview.wss?uid=swg21674232 http://www.securityfocus.com/bid/67941 https://exchange.xforce.ibmcloud.com/vulnerabilities/93302 •