entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: GHSA-2M53-83F3-562J...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

Security Bulletin: Denial of Service vulnerability in sanitize-html affects IBM Business Automation Workflow (CVE-2021-23382)

Summary A denial of service vulnerability in sanitize-html affects IBM Business Automation Workflow Workflow Center. Vulnerability Details CVEID: CVE-2021-23382 DESCRIPTION: Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service ReDoS flaw in...

Security Bulletin: Vulnerabilities in Node.js affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-22960, CVE-2021-22959

Summary Configuration Editor in IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a HTTP request smuggling attack. Vulnerability Details CVEID: CVE-2021-22960 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error when parsing the body o...

PT-2022-36645

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 2 crash has been reported. The crash occurs in the ndpi workflow process packet function, located in the fuzz ndpi reader.c fil...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

PT-2022-12315 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.2.0 Description: The issue affects users with "can create" permissions on DAG Runs, allowing them to create Dag Runs for dags they don't have "edit" permissions for. This is a specific case where the user's...

CVE-2021-43929

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Unspecified vulnerability in Delta RM (CNVD-2022-10709)

Delta Rm is a simple and effective risk management from Delta Rm France. It is used to simplify risk management methods and save time. A security vulnerability exists in Delta RM 1.2 that stems from the lack of access control on an insecure workflow reset endpoint and the fact that an unauthorize...

Design/Logic Flaw

An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the risk to be re-opened...

PT-2022-12240

Name of the Vulnerable Software and Affected Versions Delta RM version 1.2 Description An issue was discovered in the software where the "/risque/risque/workflow/reset" endpoint lacks access controls. This allows an unprivileged user to reopen a risk by sending a POST request and using the risque...

CVE-2021-44836: Authorization Bypass Through User-Controlled Key

An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the risk to be re-opened...

Security Bulletin: Cross-site scripting vulnerability affects IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-4516

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2020-4516 DESCRIPTION: IBM Business Process Manager and IBM Business Automation Workflow is vulnerable to cross-site scripting. This...

Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow - CVE-2020-4757, PSIRT-ADV0028011, CVE-2020-4934

Summary The embedded IBM Content Navigator, that is shipped with IBM Business Automation Workflow is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2020-4934 DESCRIPTION: IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: SNYK:JS-MINDASH-2340605...

CVE-2021-34996

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Security Bulletin: IBM Business Automation Workflow is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Multiple Apache Log4j vunerabilities impact Process Federation Server that is shipped with IBM Business Automation Workflow. This vulnerability includes Apache Log4j v2.17. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused b...

IBM Engineering Workflow Management has an unspecified vulnerability

IBM Engineering Workflow Management is an engineering lifecycle management solution software for project management from IBM U.S.A. A security vulnerability exists in IBM Engineering Workflow Management, which can be exploited by authenticated attackers to gain access to sensitive information...

CVE-2021-34996: Exposed Dangerous Method or Function

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...