PT-2019-9963

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.1 Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions fro...

PT-2019-16859

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and IBM Business Process Manager versions 18.0.0.0 through 18.0.0.2 Description The issue is related to a missing restriction in an API, which could allow a client to spoof the last modified by value of a...

PT-2019-9950

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and Business Process Manager versions 18.0.0.0 through 18.0.0.2 Description The issue allows an authenticated attacker to potentially cause a denial of service by sending a specially crafted request that exhaus...

CVE-2018-1997: Undefined Security Weakness

IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774...

CVE-2019-4045: Undefined Security Weakness

IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241...

CVE-2018-2000: Cross-Site Request Forgery (CSRF)

IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890...

CVE-2018-1999: Exposure of Sensitive Information to an Unauthorized Actor

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889...

CVE-2018-1885: Exposure of Sensitive Information to an Unauthorized Actor

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020...

PT-2019-9956

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.2 Description The issue could reveal sensitive version information about the server from error pages, potentially aiding an attacker in further attacks against the system...

CVE-2019-1003041

A flaw was found in the Jenkins Workflow CPS plugin. Groovy Plugins could be circumvented through methods supporting type casts and type coercion allowing attackers to invoke constructors for arbitrary types. The highest threat from this vulnerability is to data confidentiality and integrity as...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +91 more potentially affected by CVE-2019-1003041 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.56)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2019-1003041 Source advisory:...

CVE-2019-1003030

A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...

How to Mature Your Threat Hunting Program with the ATT&CK™ Framework

John Wunder, Principal Cybersecurity Engineer at MITRE spoke in a recent webinar about how the ATT&CK framework is a knowledgebase of adversary behaviors, describing the things that are tough for the adversary to change – those at the top of David J. Bianco’s influential Pyramid of Pain. Wunder...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +91 more potentially affected by CVE-2019-1003030 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.56)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2019-1003030 Source advisory:...

Workflow Component Unauthorized Access

The vulnerability of the Workflow component of the Oracle PeopleSoft Enterprise PeopleTools business application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP...

Rundeck Community Edition Cross Site Scripting

Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting

Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...