PT-2021-22316

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Automation Workflow versions 18.0 through 21.0 Description The issue allows a privileged user to obtain highly sensitive information due to improper access controls...

PT-2021-22313

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Automation Workflow versions 18.0 through 21.0 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

CVE-2021-38893

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38900

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Cross site scripting

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883

CVE-2021-38883 affects IBM Business Automation Workflow (versions 18.0.0.x, 19.0.0.x, 20.0.0.x, 21.0.x) and IBM Business Process Manager (8.5.x, 8.6.x). Root cause: cross-site scripting via the Web UI due to lack of sufficient data validation/filtering of user-supplied data during the file upload...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883: Improper Neutralization of Input During Web Page Generation

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

PT-2021-22308

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0 through 21.0 IBM Business Process Manager versions 8.5 through 8.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

Security Bulletin: Cross Site Scripting when uploading a file might affect IBM Business Automation Workflow - CVE-2021-38883

Summary IBM Business Automation Workflow may be vulnerable to a cross site scripting attack when uploading a file. Vulnerability Details CVEID: CVE-2021-38883 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Process Manager

Summary There are multiple vulnerabilities in IBM®Runtime Environment Java™Version 8 used by IBM Spectrum LSF Process Manager. IBM Spectrum LSF Process Manager has addressed the applicable CVEs. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-29753

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

Authentication flaw

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

CVE-2021-29753

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

CVE-2021-29753

CVE-2021-29753 affects IBM Cloud Pak for Automation and IBM BPM. Affected: IBM Cloud Pak for Automation (V18.0–V21.0) with BPM V8.5–V8.6. Description: the products “transmit or store authentication credentials” using an insecure method, enabling potential unauthorized interception and retrieval o...

CVE-2021-29753: Cleartext Transmission of Sensitive Information

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

PT-2021-18453

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18 through 21 IBM Business Process Manager versions 8.5 and 8.6 Description The software transmits or stores authentication credentials using an insecure method, making it susceptible to unauthorized...