Bonita BPM Portal <6.5.3 - Local File Inclusion

Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource. id: CVE-2015-3897 info: name: Bonita BPM Portal 6.5.3 - Local File Inclusion author: 0xAkoko severity:...

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

Bonita Portal Login - Detect

Detects the presence of Bonita Portal login page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Bonita Portal login page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bonita Portal Login -...

EUVD-2015-3933

Malware in sbrugna...

CVE-2024-27609

Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel...

CVE-2022-25237

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API...

CVE-2020-36640

A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external...

VulnCheck KEV: CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

Insecure Direct Object Reference (IDOR)

org.bonitasoft.engine, bonita-server is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to the absence of dynamic permissions, which previously existed only in the Subscription edition and were not customizable in the Community edition...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.0), org.bonitasoft.engine:bonita-engine-standalone (7.9.0) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.0)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.0 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.1), org.bonitasoft.engine:bonita-engine-standalone (7.9.1) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.1)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.1 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.2), org.bonitasoft.engine:bonita-engine-standalone (7.9.2) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.2)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.2 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.3), org.bonitasoft.engine:bonita-engine-standalone (7.9.3) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.3)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.3 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.4), org.bonitasoft.engine:bonita-engine-standalone (7.9.4) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.4)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.4 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.5), org.bonitasoft.engine:bonita-engine-standalone (7.9.5) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.9.5)

org.bonitasoft.engine:bonita-server MAVEN version 7.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.5 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.0), org.bonitasoft.engine:bonita-engine-standalone (7.10.0) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.10.0)

org.bonitasoft.engine:bonita-server MAVEN version 7.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.0 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.3), org.bonitasoft.engine:bonita-engine-standalone (7.10.3) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.10.3)

org.bonitasoft.engine:bonita-server MAVEN version 7.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.3 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.4), org.bonitasoft.engine:bonita-engine-standalone (7.10.4) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.10.4)

org.bonitasoft.engine:bonita-server MAVEN version 7.10.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.4 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.5), org.bonitasoft.engine:bonita-engine-standalone (7.10.5) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.10.5)

org.bonitasoft.engine:bonita-server MAVEN version 7.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.5 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.6), org.bonitasoft.engine:bonita-engine-standalone (7.10.6) potentially affected by CVE-2024-28087 via org.bonitasoft.engine:bonita-server (7.10.6)

org.bonitasoft.engine:bonita-server MAVEN version 7.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.engine:bonita-server and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.6 -...