Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) redirect-login mechanism (CVE-2014-6101)

Summary IBM Business Process Manager uses a mechanism to silently login users who have previously authenticated themselves. This mechanism is vulnerable to cross-site scripting attacks. Vulnerability Details CVE ID: CVE-2014-6101 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-si...

Security Bulletin: Vulnerabilities in IBM Business Process Manager (BPM) DocumentStore administration (CVE-2014-0107, CVE-2014-4763)

Summary IBM Business Process Manager BPMV8.5.5.0 includes a web based application for administering the IBM BPM DocumentStore. A cross-site scripting vulnerability CVE-2014-4763 and an open source library for XML processing vulnerability CVE-2014-0107 have been reported in this web based...

Security Bulletin: Security vulnerabilities in Node.js modules affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-6394, CVE-2014-7191)

Summary Security vulnerabilities have been reported for some dependent Node.js modules. IBM Business Process Manager includes a stand-alone tool for editing configuration properties files that is based on open source Node.js technology. Vulnerability Details CVE-ID: CVE-2014-6394 Description:...

Security Bulletin: Incorrect authorization in IBM Business Process Manager (BPM) Saved Search Admin (CVE-2014-4802)

Summary When you create and run a saved search from the Saved Search Admin tab of the Process Admin Console, the result set might contain tasks or instances that the current user is not authorized to see. Vulnerability Details CVE ID:CVE-2014-4802 DESCRIPTION: IBM Business Process Manager Saved...

Security Bulletin: A security vulnerability in Node.js affects the IBM Business Process Manager (BPM) configuration editor (CVE-2014-5256)

Summary IBM Business Process Manager V8.5.5 provides a standalone tool for editing configuration properties files that is called the "IBM BPM Configuration editor." This editor is based on open source Node.js technology. A security vulnerability has been reported for Node.js. Vulnerability Detail...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Process Server and IBM Business Process Manager (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Process Server and IBM Business Process Manager. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An...

Security Bulletin: Information disclosure in IBM Business Process Manager (BPM) V8.5 document attachments search (CVE-2014-4759)

Summary IBM BPM document attachment queries can return document properties that contain sensitive information. Vulnerability Details CVE ID: CVE-2014-4759 DESCRIPTION: An Ajax service that is shipped with the Content Management toolkit allows users to search for IBM BPM document attachments from...

Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758)

Summary When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. Vulnerability Details CVE ID: CVE-2014-4758 DESCRIPTION: IBM Business Process Manager and...

Security Bulletin: Insufficient control over MIME types in Business Process Manager (BPM) and WebSphere Lombardi Edition document feature (CVE-2014-3075)

Summary You cannot restrict file uploads by MIME type in a document list coach view. As a result, potentially malicious files, such as HTML that contains embedded JavaScript can be uploaded and run in the browser. Vulnerability Details CVE ID: CVE-2014-3075 DESCRIPTION: IBM BPM document managemen...

Security Bulletin: Unauthorized disclosure of system information in IBM Business Process Manager (BPM) 8.5.x (CVE-2014-3076)

Summary System information is provided on an unprotected diagnostic page. Vulnerability Details CVEID: CVE-2014-3076 DESCRIPTION: IBM Business Process Manager 8.5 contains an unprotected JavaServer™ Pages JSP file that returns system information to unauthenticated users. An attacker might use thi...

Security Bulletin: IBM WebSphere Lombardi Edition and IBM Business Process Manager (BPM) cross-site scripting vulnerability in error situations (CVE-2014-0957)

Summary When you invoke a service using a URL, user input can be returned in unhandled service failure situations. Vulnerability Details CVE ID: CVE-2014-0957 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager are vulnerable to cross-site scripting that is caused by the...

Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) and Denial Of Service vulnerability in Apache Commons FileUpload (CVE-2014-0050) affect IBM Business Process Manager (BPM) V8.5.5.0

Summary Security vulnerabilities have been reported for the Apache Struts 1.1 and Apache Commons FileUpload libraries shipped with one component of IBM Business Process Manager V8.5.5. Vulnerability Details The vulnerable libraries are used only in an administrative user interface that, by defaul...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server which is shipped with IBM WebSphere Process Server and IBM Business Process Manager (IBM SDK for Java CPU April 2014)

Summary IBM WebSphere Application Server is shipped as a component of IBM WebSphere Process Server and IBM Business Process Manager. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For...

Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) affects WebSphere Lombardi Edition and IBM Business Process Manager (BPM)

Summary There is a class loader manipulation vulnerability in Apache Struts CVE-2014-0114 that affects WebSphere Lombardi Edition and IBM Business Process Manager. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts 1.X might allow a remote attacker to execute arbitrary code on...

Security Bulletin: Denial of Service vulnerability in Apache Commons FileUpload affects IBM Business Process Manager (BPM)

Summary A security vulnerability exists in the open source library Apache Commons FileUpload that is shipped with, and used by, the IBM Business Process Manager products. Vulnerability Details By sending a specially crafted request, an attacker might exploit this vulnerability to cause the...

Security Bulletin: Missing authorization concept for IBM Business Process Manager (BPM) User Attributes CVE-2014-0908

Summary The User Attribute feature in IBM Business Process Manager does not have an authorization concept. Vulnerability Details As a consequence, each user can read and update their own attribute values and the attribute values for another user by using REST APIs. However, there are...

Incorrect Access Control in Phusion Passenger

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates a...

Quest NetVault Backup NVBUEventHistory Get Method SQL Injection (CVE-2017-17412)

An SQL injection vulnerability exists in the Server Process Manager Service of Quest NetVault Backup. The vulnerability is due to improper validation of user-supplied input on JSON-RPC requests invoking the Get method of the NVBUEventHistory class...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2018-07654)

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM B...

IBM Business Process Manager Information Disclosure Vulnerability (CNVD-2018-08192)

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A security vulnerability exists in IBM BPM version...