Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 - Includes Oracle April 2024 CPU plus CVE-2023-38264

Summary IBM SDK, Java Technology Edition is vulnerable to CVE-2023-38264. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Workflow Management Vulnerability Details Refer to the security bulletins listed...

CVE-2024-8263: Improper Privilege Management

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. Thi...

IBM Business Automation Workflow Input Validation Error Vulnerability (CNVD-2024-46816)

IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. An input validation error vulnerability exists in...

Unspecified Vulnerability in JetBrains YouTrack (CNVD-2025-16856)

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...

CVE-2024-47159

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project...

CVE-2024-47159

CVE-2024-47159 affects JetBrains YouTrack prior to 2024.3.44799. The public descriptions in multiple sources (including Red Hat’s advisory and vendor references) state that a user lacking appropriate permissions could restore workflows attached to a project, implying an unintended privilege/autho...

CVE-2024-47159: Incorrect Authorization

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project...

PT-2024-6625

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.44799 Description: The issue is related to insufficient authorization mechanisms in JetBrains YouTrack, allowing a remote attacker to exploit the vulnerability and potentially elevate their privileg...

A Bootiful Podcast: Flowable cofounder and my friend Joram Barrez on workflow, case management, AI, Spring, and so much more

Hi, Spring fans! In this installment I catch up with my friend Joram Barrez, cofounder of Flowable, an amazing and opensource workflow engine, on their latest and greatest, AI, Spring, and so much more. workflow bpmn apache2 springboot java...

Chicheng JFLow Access Control Vulnerability

Chicheng JFLow is a workflow engine form from China Chicheng Chicheng. An access control error vulnerability exists in Chicheng JFLow version 2.0.0, which stems from a parameter oid in file /WF/Ath/EntityMutliFileLoad.do that can lead to improper access control...

lm-eval (>=0.0.1, <=0.2.0), remote-sqlitedict (>=0.3.8, <=0.4.2) +1 more potentially affected by CVE-2024-35515 via sqlitedict (1.6.0)

sqlitedict PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlitedict and may be impacted: - lm-eval =0.0.1, =0.3.8, =1.1.0, =1.14.16 Source cves: CVE-2024-35515 Source advisory: OSV:GHSA-G4R7-86GM-PGQC...

CVE-2024-43188

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...

CVE-2024-43188

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...

CVE-2024-43188

CVE-2024-43188 affects IBM’s Business Automation Workflow Center and related components. The issue arises from improper client-side input validation, enabling a privileged user to perform unauthorized activities in affected releases. Affected versions include IBM Business Automation Workflow trad...

CVE-2024-43188 IBM Business Automation Workflow improper input validation

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...

CVE-2024-43188 IBM Business Automation Workflow improper input validation

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...

PT-2024-30362

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 22.0.2 through 24.0.0 Description The issue allows a privileged user to perform unauthorized activities due to improper client-side validation. This could lead to unauthorized access. Recommendations F...

CVE-2024-43188: Client-Side Enforcement of Server-Side Security

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...

IBM Business Automation Workflow security vulnerabilities

IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. An input validation error vulnerability exists in...

PT-2024-33799

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved, related to the ocfs2 filesystem. The issue occurred during the reflink workflow while reserving space for inline xattr, causing...