CVE-2019-4410

CVE-2019-4410 affects IBM Business Automation Workflow and IBM BPM. The IBM Security Bulletin documents a cross-site scripting vulnerability in IBM Business Automation Workflow 18.0.0.0–18.0.0.2 and 19.0.0.1 (and BPM variants) that allows embedding arbitrary JavaScript in the Web UI, potentially ...

@convergence/mxgraph-adapter (>=0.1.0, <=0.2.0), vue-workflow-modeler (>=0.1.3, <=0.1.6) potentially affected by CVE-2019-13127 via mxgraph (3.9.12)

mxgraph NPM version 3.9.12 is affected by a known vulnerability. The following packages have a transitive dependency on mxgraph and may be impacted: - @convergence/mxgraph-adapter =0.1.0, =0.1.3, =0.1.6 Source cves: CVE-2019-13127 Source advisory: MEND:CVE-2019-13127...

PT-2019-17068 · Ibm · Ibm Business Automation Workflow

Name of the Vulnerable Software and Affected Versions: IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.2 IBM Business Automation Workflow version 19.0.0.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality an...

CVE-2019-4410: Improper Neutralization of Input During Web Page Generation

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

Arbitrary Code Execution

jenkins-plugin-workflow-cps is vulnerable to arbitrary code execution. A sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin allows an attacker to invoke arbitrary contructors in sandboxed scripts...

jenkins-plugin-workflow-cps: Sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin (SECURITY-1353)

A flaw was found in the Jenkins Workflow CPS plugin. Groovy Plugins could be circumvented through methods supporting type casts and type coercion allowing attackers to invoke constructors for arbitrary types. The highest threat from this vulnerability is to data confidentiality and integrity as...

Unsafe entry in Script Security list of approved signatures in workflow-remote-loader

workflow-remote-loader provides a custom list of pre-approved signatures for Script Security. Those entries apply to all scripts with sandbox protection, such as Pipeline. One entry provided here was unsafe, as it allowed invoking arbitrary methods, bypassing sandbox protection. The unsafe...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7 used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2602 DESCRIPTION: An unspecified vulnerability related t...

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049

The Workflow module enables you to create arbitrary Workflows, and assign them to Entities. The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

CVE-2019-4204

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2019-4204

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

Cross site scripting

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2019-4204

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2019-4204

This CVE is an XSS vulnerability in IBM Business Automation Workflow and IBM BPM (CVE-2019-4204). Affected products/versions: IBM Business Automation Workflow 18.0.0.0–19.0.0.1; IBM BPM 8.5.7.0–8.6.0.0 CF2017.06 and 8.6.0.0 CF2018.03. The issue allows arbitrary JavaScript in the Web UI, potential...

CVE-2019-4204: Improper Neutralization of Input During Web Page Generation

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

PT-2019-16963

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.2 IBM Business Automation Workflow version 19.0.0.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

CVE-2019-10272: Improper Neutralization of CRLF Sequences

An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring...

PT-2019-11676

Name of the Vulnerable Software and Affected Versions Weaver e-cology version 9.0 Description A CRLF Injection issue was found, which can be exploited via the "isintervenor" parameter in the /workflow/request/ViewRequestForwardSPA.jsp endpoint. This is demonstrated by the use of the %0aSet-cookie...

IBM Business Automation Workflow and IBM Business Process Manager Information Disclosure Vulnerability

IBM Business Process Manager BPM and IBM Business Automation Workflow are both products of IBM Corporation, U.S.A. IBM Business Process Manager is a comprehensive business process management platform. The platform provides a series of related tools for business process modeling, assembly,...

IBM Business Process Manager and IBM Business Automation Workflow Cross-Site Request Forgery Vulnerability

IBM Business Process Manager BPM and IBM Business Automation Workflow are both products of IBM Corporation, U.S.A. IBM Business Process Manager is a comprehensive business process management platform. The platform provides a series of related tools for business process modeling, assembly,...