Cross site scripting

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

Sql injection

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2947

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2947

Bizagi BPM Suite (all versions) contains a reflected XSS in Login.aspx exposed via the txtUsername parameter. CVE-2014-2947 affects Bizagi BPM Suite before 10.3, enabling remote attackers to inject arbitrary JavaScript/HTML in the victim’s browser. CERT/ENISA notes the vulnerability as XSS with a...

CVE-2014-2948

Bizagi BPM Suite (workflowenginesoa.asmx) is affected by CVE-2014-2948, a SQL injection vulnerability reported to allow a remote authenticated attacker to execute arbitrary SQL via a crafted SOAP request. The issue targets the workflowenginesoa.asmx web service and is described alongside an addit...

PT-2014-4975

Name of the Vulnerable Software and Affected Versions Bizagi BPM Suite versions prior to 10.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter in the "Login.aspx" page. Recommendations For versions prior to...

PT-2014-4976

Name of the Vulnerable Software and Affected Versions Bizagi BPM Suite versions prior to 10.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request to the workflowenginesoa.asmx endpoint. Recommendations For versions prior to 10.4,...

CVE-2014-2948: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2947: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

Bizagi BPM Suite contains multiple vulnerabilities

Overview Bizagi BPM Suite contains a reflected cross-site scripting vulnerability and a SQL injection vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-2947According to Open-Sec consultant Mauricio Urizar, all versions...

Authorization

The User Attribute implementation in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information,...

CVE-2014-0908

IBM BPM's User Attribute feature (Standard/Express/Advanced) across 7.5.x, 8.0.x, 8.5.x does not enforce authorization for read/write of attribute values via REST, enabling remote authenticated users to read or modify attributes and affect email notifications or task assignments. Affected version...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468

CVE-2013-6468 affects JBoss Drools and Red Hat JBoss BRMS/BPM Suite prior to 6.0.1. The flaw allows remote authenticated users to execute arbitrary Java code via MVFLEX (MVEL) or Drools expressions, caused by unsafe expression handling. Red Hat advisories RHSA-2014:0371/0372 document the fix in B...

PT-2014-3130

Name of the Vulnerable Software and Affected Versions Red Hat JBoss BRMS versions prior to 6.0.1 Red Hat JBoss BPM Suite versions prior to 6.0.1 JBoss Drools affected versions not specified Description The issue allows remote authenticated users to execute arbitrary Java code. This can be achieve...

CVE-2013-6468: Improper Control of Generation of Code

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update

Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...