PT-2015-4471

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.0 through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0 through 8.5.0.1 IBM Business Process Manager BPM versions 8.5.5 through 8.5.5.0 Description The issue concerns multiple cross-site...

PT-2015-4472

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.0 through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0 through 8.5.0.1 IBM Business Process Manager BPM versions 8.5.5 through 8.5.5.0 Description A cross-site scripting XSS issue exists i...

PT-2014-7091

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.0.x through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.x through 8.5.5 Description A directory traversal issue exists in the export function of the Process Center, allowing remote...

PT-2014-7046

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM Advanced versions 7.5 through 8.5.5 Description A cross-site scripting XSS issue exists in the redirect-login feature, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6101: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the redirect-login feature in IBM Business Process Manager BPM Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2014-6101

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.5.x through 8.5.5 Description The issue allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search...

CVE-2014-3076: Exposure of Sensitive Information to an Unauthorized Actor

IBM Business Process Manager BPM 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page...