Multiple Cross-Site Scripting Vulnerabilities in IBM Business Process Manager

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in Proce...

PT-2015-4471

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.0 through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0 through 8.5.0.1 IBM Business Process Manager BPM versions 8.5.5 through 8.5.5.0 Description The issue concerns multiple cross-site...

PT-2015-4473

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 7.5.x through 7.5.1.2 IBM Business Process Manager BPM versions 8.0 through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0 through 8.5.0.1 IBM Business Process Manager BPM versions 8.5.5 throu...

PT-2015-4506

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager BPM versions 8.0 through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0 through 8.5.0.1 IBM Business Process Manager BPM versions 8.5.5 through 8.5.5.0 Description A cross-site scripting XSS issue exists i...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2015-01946)

IBM Business Process Manager BPM is a comprehensive set of business process management platforms from IBM in the U.S. It provides a range of tools related to business process modeling, assembly, monitoring, and deployment.WebSphere Lombardi Edition WLE is the predecessor of the BPM product. A...

CVE-2015-0105

CVE-2015-0105 is an XSS vulnerability in IBM BPM’s Process Portal affecting BPM Standard/Express/Advanced 8.0.x before 8.0.1.3, 8.5.0 before 8.5.0.1, and 8.5.5 before 8.5.5.0. Root cause: improper validation/filtering of user-supplied input, allowing a crafted URL to execute script in a user’s br...

CVE-2015-0103: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Process Portal in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields...

CVE-2015-0158: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Coach NG framework in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0105: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Process Portal in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

IBM Business Process Manager Search REST API Access Bypass Vulnerability

IBM Business Process Manager is a comprehensive BPM platform that integrates WebSphere Lombardi, the industry's leading human-centric business process management platform, and WPS, a business process management platform centered on SOA integration. A security vulnerability exists in IBM BPM's...

CVE-2014-6139

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter...

CVE-2014-6139

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter...

CVE-2014-6139

The CVE concerns IBM Business Process Manager (BPM) Search REST API allowing authenticated non-administrative users to bypass access controls by supplying an incorrect filterByCurrentUser value, enabling discovery of task- and process-instances the user should not see. Affected BPM products/versi...

CVE-2014-6139: Undefined Security Weakness

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter...

PT-2015-3820

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.0.1.3, 8.5.0.1, 8.5.5.0 Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by specifying a false value for the filterByCurrentUser parameter ...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2015-00568)

IBM Business Process Manager is a comprehensive business process management platform. A cross-site scripting vulnerability in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 allows a remote, authenticated user to inject arbitrary web script or HTML via a crafted URL...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2015-00569)

IBM Business Process Manager is a comprehensive business process management platform. A cross-site scripting vulnerability in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 allows a remote, authenticated user to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8913

Cross-site scripting XSS vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8914...

Cross site scripting

Cross-site scripting XSS vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8914...

Cross site scripting

Cross-site scripting XSS vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8913...