PT-2024-39968 · Newtype · Flowmaster Bpm Plus

Name of the Vulnerable Software and Affected Versions: FlowMaster BPM Plus affected versions not specified Description: The FlowMaster BPM Plus system from NewType has a privilege escalation issue. Remote attackers with regular privileges can elevate their privileges to administrator by tampering...

VulnCheck KEV: CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

CVE-2024-4754

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-5683

Improper Control of Generation of Code 'Code Injection' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Remote Code Inclusion. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-4754

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-4754 Stored XSS in Next4Biz's BPM

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-4754 Stored XSS in Next4Biz's BPM

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-5683 Remote Code Execution in Next4Biz's BPM

Improper Control of Generation of Code 'Code Injection' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Remote Code Inclusion. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-5683 Remote Code Execution in Next4Biz's BPM

Improper Control of Generation of Code 'Code Injection' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Remote Code Inclusion. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-5683

CVE-2024-5683 is an improper control of generation of code vulnerability in Next4Biz BPM software. Multiple connected records confirm the issue affects Next4Biz BPM/CRM with vulnerable versions: 6.6.4.4 prior to 6.6.4.5, indicating a flaw in code generation controls that can lead to remote code e...

PT-2024-26315 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: A SQL injection issue was found in the findPage function within BpmTaskFromMapper.xml. Recommendations: For version 2.7.0, consider restricting access to the findPage function in BpmTaskFromMapper.xml until...

J2EEFAST 安全漏洞

J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free back-end framework platform . J2EEFAST v2.7.0 version of the SQL injection vulnerability , the vulnerability stems from the BpmTaskFromMapper.xml findPage...

PT-2024-25129 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: A SQL injection issue was discovered via the sql filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. This allows for potential exploitation. No information is provided about the...

BIT-JASPERREPORTS-2020-9409

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a...

BIT-JASPERREPORTS-2022-22773

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Serv...

cn.sparrowmini:sparrow-bpm (=0.0.1), cn.sparrowmini:sparrow-form (=0.0.1) +13 more potentially affected by CVE-2023-50571 via org.jeasy:easy-rules-mvel (=4.1.0)

org.jeasy:easy-rules-mvel MAVEN version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jeasy:easy-rules-mvel and may be impacted: - cn.sparrowmini:sparrow-bpm =0.0.1 - cn.sparrowmini:sparrow-form =0.0.1 -...

bpm-legal.de Improper Access Control vulnerability OBB-3817673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bpm-legal.de Improper Access Control vulnerability OBB-3766794

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the ConnectionStrings.config component in the “Terrasoft” CRM system and the “Creatio” BPM system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ConnectionStrings.config component in the “Terrasoft” CRM system and the “Creatio” BPM system is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

Security Bulletin: IBM Sterling Global Mailbox is vulnerable to arbitrary command execution due to com.ibm.ws.org.apache.commons.collections (CVE-2015-7501)

Summary A security vulnerability has been identified and addressed in com.ibm.ws.org.apache.commons.collections.3.2.1-1.0.9.jar shipped with IBM Sterling Global Mailbox. Vulnerability Details CVEID:CVE-2015-7501 DESCRIPTION: Red Hat JBoss A-MQ 6.x; BPM Suite BPMS 6.x; BRMS 6.x and 5.x; Data Grid...