CVE-2018-1932

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	API Connect	5.0.0.0; 5.0.8.4

References

http://www.ibm.com/support/docview.wss?uid=ibm10793601Patch, Vendor Advisory
http://www.securityfocus.com/bid/106486Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/153175VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10793601Patch, Vendor Advisory
http://www.securityfocus.com/bid/106486Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/153175VDB Entry, Vendor Advisory

Timeline

Published: Jan 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-193207.8The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, CVE-2018-193217.8The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE CVE-2018-193227.8The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE CVE-2018-193239.8The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, CVE-2018-193245.4kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.CVE-2018-193267.5Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.CVE-2018-193278.8An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.CVE-2018-193289.8LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.CVE-2018-193294.9GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin CVE-2018-19335.4IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip CVE-2018-193317.5An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.CVE-2018-193328.8An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add U