CVE-2018-1468

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized. IBM X-Force ID: 140399.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	API Connect	5.0.8.1; 5.0.8.2

References

http://www.ibm.com/support/docview.wss?uid=swg22015968Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140399VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22015968Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140399VDB Entry, Vendor Advisory

Timeline

Published: May 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146806.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.CVE-2018-146818.8An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a CVE-2018-146828.8An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompres CVE-2018-146836.1PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.CVE-2018-146859.8The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a craf CVE-2018-146866.1system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request, related to add_book.php.CVE-2018-146886.1An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the name[CVE-2018-146896.1An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the CVE-2018-14699.8IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially CVE-2018-146906.1An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title CVE-2018-146916.1An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0 CVE-2018-146957.5Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to