Security Bulletin: IBM Business Process Manager (BPM) document store is affected by clickjacking vulnerability in administrative tool for BPM document store (CVE-2013-5462)

Summary A clickjacking vulnerability has been reported for the administrative tool ACCE of the embedded component used by IBM BPM document store. Vulnerability Details CVEID: CVE-2013-5462 DESCRIPTION: The IBM Content Navigator application URL can be opened within a frame in a Web page. In this...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Business Process Manager, WebSphere Process Server and WebSphere Lombardi Edition (Java CPU October 2016)

Summary WebSphere Application Server is shipped as a component of IBM Business Process Manager, WebSphere Process Server, and WebSphere Lombardi Edition. WebSphere Application Server Liberty is shipped as a component of the optional BPM component Process Federation Server. Information about...

Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-9748, CVE-2016-1669)

Summary Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Process Manager includes a stand-alone tool for editing configuration properties files that is based IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2014-9748 DESCRIPTION: libuv, as used in Node.js is...

Security Bulletin: IBM Business Process Manager (BPM) document store is susceptible to XXE (XML External Entity) attacks. (CVE-2013-5452)

Summary An XML eXternal Entity XXE vulnerability has been reported for the embedded component used by IBM BPM document store. Vulnerability Details CVEID: CVE-2013-5452 DESCRIPTION: The IBM FileNet Business Process Framework is vulnerable to an XML external entity attack. A remote attacker could...

Security Bulletin: JavaScript evaluation vulnerability in IBM Business Process Manager (CVE-2015-1961)

Summary Due to insufficient validation of input parameters and the failure to honor a configuration setting, authenticated users can send JavaScript for execution on the server side. Vulnerability Details CVEID: CVE-2015-1961 DESCRIPTION: IBM Business Process Manager could allow a remote...

Security Bulletin: Cross-site scripting vulnerabilities in IBM Business Process Manager (BPM) Process Portal (CVE-2014-8913, CVE-2014-8914)

Summary Insufficient user input validation in IBM Business Process Manager's Process Portal can lead to a cross-site scripting exposure. Vulnerability Details CVEID: CVE-2014-8913 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site scripting, which is caused by the improper...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) redirect-login mechanism (CVE-2014-6101)

Summary IBM Business Process Manager uses a mechanism to silently login users who have previously authenticated themselves. This mechanism is vulnerable to cross-site scripting attacks. Vulnerability Details CVE ID: CVE-2014-6101 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-si...

Security Bulletin: Insufficient control over MIME types in Business Process Manager (BPM) and WebSphere Lombardi Edition document feature (CVE-2014-3075)

Summary You cannot restrict file uploads by MIME type in a document list coach view. As a result, potentially malicious files, such as HTML that contains embedded JavaScript can be uploaded and run in the browser. Vulnerability Details CVE ID: CVE-2014-3075 DESCRIPTION: IBM BPM document managemen...

UBUNTU-CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...

CVE-2018-5431

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a...

CVE-2018-5429

A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports...

CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...

CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...

CVE-2018-5431

CVE-2018-5431 affects TIBCO JasperReports Server family: JasperReports Server (up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2), JasperReports Server Community Edition (up to 6.4.2), JasperReports Server for ActiveMatrix BPM (up to 6.4.2), TIBCO Jaspersoft for AWS with Multi-Tenancy (up to 6.4.2),...

CVE-2018-5429 TIBCO JasperReports Library Code Sandboxing Problem

A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports...

CVE-2018-5430 TIBCO JasperReports Server Information Disclosure Vulnerability

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...

CVE-2018-5431

Removed by vendor...

Design/Logic Flaw

IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150...

CVE-2017-1765

CVE-2017-1765 affects IBM Business Process Manager (BPM) 8.6 and multiple earlier versions, where an authenticated user with special privileges could reveal sensitive information about the application server during snapshot export. The IBM bulletin consolidates affected BPM editions (V8.0.0.0–V8....

CVE-2017-1766

CVE-2017-1766 is an IBM BPM authentication issue in which an authenticated user can claim and work on ad hoc tasks without the required permissions. IBM BPM versions affected include 8.5.5.0, 8.5.6.0 (through 8.5.6.0 CF2), 8.5.7.0 (through 8.5.7.0 Cumulative Fix 2017.06), and 8.6.0.0 (through 8.6...