| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths. |
| In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization. |
| apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it. |
| Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory. |
| Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application. |
| In the Linux kernel, the following vulnerability has been resolved:
ksmbd: hold a connection reference for each session channel
ksmbd_session_unregister() removes a session from the global and per-
connection tables before dropping the table reference. A concurrent
reference holder can keep the session and its channel list alive after
those removals.
Connection cleanup can no longer find the unpublished session to remove its
channels. Since a channel only stores a raw conn pointer, the connection
can be freed while another session reference holder is still accessing it,
for example during SMB3.1.1 binding or a procfs read.
Take a connection reference when registering a channel and release it on
insertion failure, channel removal, or final session destruction. Keep the
channels and signing keys until the session is destroyed so a response can
still be signed after the session has been unregistered. |
| In the Linux kernel, the following vulnerability has been resolved:
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081. |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. |
