CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-1818

CVE-2015-1818 affects Red Hat JBoss BPM Suite's dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) where XML External Entity (XXE) processing was not disabled, enabling read of arbitrary files and SSRF via crafted XML. Impact is partial confidentiality/...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.2 update

Red Hat JBoss BPM Suite 6.1.2, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores...

Deserialization of untrusted data

IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...

CVE-2015-1904

IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...

CVE-2015-1904

CVE-2015-1904 affects IBM BPM (BPM) versions 8.0.x through 8.5.6.0 when external ECM integration uses a predefined technical system account, enabling remote authenticated users to bypass document-access restrictions for upload or download. The IBM security bulletin specifies a BPM CMIS integratio...

CVE-2015-1905

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors...

Design/Logic Flaw

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors...

CVE-2015-1906

CVE-2015-1906 is an XSS vulnerability in the IBM Business Process Manager (BPM) REST API. A remote authenticated user can inject script via a crafted URL in BPM versions 7.5.x–8.5.6.0. Exploitation details are not provided beyond the vulnerability description. IBM’s advisory recommends installing...

CVE-2015-1905

CVE-2015-1905 affects IBM Business Process Manager (BPM) REST API in BPM versions 7.5.x–8.5.6.0. The vulnerability arises from insufficient authorization checks, allowing remote authenticated users to bypass intended access restrictions on task-variable value changes via the REST API. The IBM adv...

CVE-2015-1905

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors...

CVE-2015-1961

Summary: CVE-2015-1961 affects IBM Business Process Manager (BPM) versions 7.5.1–7.5.1.2, 8.0.x–8.0.1.3, 8.5.0–8.5.0.1, 8.5.5–8.5.5.0, and 8.5.6–8.5.6.0. The issue arises from insufficient input validation and a misapplied configuration setting in a BPM REST API variant, allowing remote authentic...

CVE-2015-1884

Directory traversal vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted...

Directory traversal

Directory traversal vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted...

CVE-2015-1884

IBM Business Process Manager (BPM) and WebSphere Lombardi Edition are affected by a directory traversal vulnerability (CVE-2015-1884) due to insufficient input validation in the internationalization-file URL. Vulnerable products/versions include BPM Standard/Express/Advanced 7.5.x–8.5.5.0 and WLE...

CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

Directory traversal

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

CVE-2015-3897

Bonita BPM Portal before 6.5.3 is affected by two concrete issues: (1) Local File Inclusion via themeResource when theme and location contain .., allowing reading arbitrary server files; (2) Open Redirect via redirectUrl parameter, enabling redirection to arbitrary sites after login. The NVD/Nucl...

CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...