Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Process Server

Summary WebSphere Application Server is shipped as a component of WebSphere Process Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

Security Bulletin: WebSphere Process Server (WPS) / IBM Business Process Manager (BPM) – Cross-site scripting security vulnerability in local help system

Summary A Cross-site scripting security vulnerability exists in the IBM Eclipse Help System, which is used to provide the product information centers for the IBM WebSphere Process Server and IBM Business Process Manager products. For more details about Cross-site Scripting XSS, see the Open Web...

Security Bulletin: A CVE-2021-37714 vulnerability in jsoup affects IBM Process Designer in IBM Business Automation Workflow and IBM Business Process Manager

Summary A vulnerabilitiy exists in jsoup used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-37714 DESCRIPTION: jsoup is vulnerable to a denial of service, caused by improper input validation. By sending ...

Security Bulletin: CVE-2015-7450 affects the desktop IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager

Summary The following vulnerability in Apache commons that affects the desktop IBM Process Designer has been addressed. Vulnerability Details CVEID:CVE-2015-7450 DESCRIPTION: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and...

Security Bulletin: Denial of service vulnerability in IBM Business Automation Workflow (CVE-2018-1997)

Summary A denial of service vulnerability has been found in IBM Business Automation Workflow. Vulnerability Details CVEID: CVE-2018-1997 DESCRIPTION: IBM Business Automation Workflow and Business Process Manager are vulnerable to a denial of service attack. An authenticated attacker might send a...

Security Bulletin: Security vulnerability in Business Space affects IBM Business Process Manager and WebSphere Process Server (CVE-2014-8912)

Summary Business Space is a user interface framework that is available in WebSphere Process Server and IBM Business Process Manager BPM. In IBM BPM Express Edition and Standard Edition the framework is not used directly by end users, however, it is still available and contributes parts of the...

Security Bulletin: Multiple security vulnerabilities in Business Space affect IBM Business Process Manager and WebSphere Process Server (CVE-2015-7407, CVE-2015-7400, CVE-2015-7454)

Summary Business Space is a user interface framework that is available in WebSphere Process Server and IBM Business Process Manager BPM. In IBM BPM Express Edition and Standard Edition the framework is not used directly by end users, however, it is still available and contributes parts of the...

Security Bulletin: Incorrect SSL/TLS handling in Remote Artifact Loader in IBM Business Process Manager Advanced and WebSphere Process Server

Summary IBM WebSphere Process Server and IBM Business Process Manager Advanced have a component "Remote Artifact Loader" RAL that allows access to artifacts contained in other applications. In remote access cases a HTTPS connection from the RAL client to the RAL server is established. This HTTPS...

Security Bulletin: Incorrect SSL protocol variant in SCA HTTP binding affecting WebSphere Enterprise Service Bus, WebSphere Process Server and IBM Business Process Manager Advanced (CVE-2014-6176)

Summary The HTTP import binding in an SCA module can be configured with a reference to a SSL configuration that exists on the application server. The HTTP binding uses always the SSLv3 protocol variant regardless of the SSL protocol setting in the referenced SSL configuration. Vulnerability Detai...

Security Bulletin: A security vulnerability in Node.js affects the IBM Business Process Manager (BPM) configuration editor (CVE-2014-5256)

Summary IBM Business Process Manager V8.5.5 provides a standalone tool for editing configuration properties files that is called the "IBM BPM Configuration editor." This editor is based on open source Node.js technology. A security vulnerability has been reported for Node.js. Vulnerability Detail...

CVE-2015-0101

The CVE-2015-0101 issue is an XSS vulnerability in IBM Business Process Manager across Standard, Express, and Advanced lines (versions 7.5.x, 8.0.x, 8.5.x). It stems from insufficient input validation in BPM’s Process Center, allowing a remote attacker to craft a URL that executes script in a vic...

CVE-2015-7454: Undefined Security Weakness

Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote authenticated users to bypass intended access...

CVE-2014-6176: Undefined Security Weakness

IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which...