PT-2022-15662 · Tibco · Tibco Jasperreports Server +5

Name of the Vulnerable Software and Affected Versions: TIBCO JasperReports Library version 7.9.0 TIBCO JasperReports Library for ActiveMatrix BPM version 7.9.0 TIBCO JasperReports Server versions 7.9.0 through 7.9.1 TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 through 7.9.1 TIBCO...

Oracle Business Process Management Suite (Jan 2022 CPU)

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: Installer Apache Commons Compress. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access...

Improper access control

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

CVE-2021-38900

CVE-2021-38900 affects IBM BPM 8.5/8.6 and IBM BAW 18.0–21.0, where improper access controls could allow a privileged user to obtain highly sensitive information. Public sources (IBM Security Bulletin, IBM support pages, and related advisories) detail affected product versions within IBM Cloud Pa...

CVE-2021-29753

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

SAP NetWeaver XML External Entity (XXE) Vulnerability

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity XXE attacks...

CVE-2021-35496 TIBCO JasperReports XML Eternal Entity (XXE) vulnerability

The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AW...

CVE-2021-35495 TIBCO JasperReports FTP Password exposed

The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server fo...

CVE-2021-29834

The CVE-2021-29834 entry concerns a stored cross-site scripting (XSS) vulnerability in IBM Business Automation Workflow and IBM Business Process Manager (BPM). According to IBM’s Security Bulletin, the affected versions are IBM Business Automation Workflow: V18.0, 19.0, 20.0, 21.0.2 and V20.0.2 p...

Security Bulletin: Vulnerability in SSLv3 affects FileNet Content Manager, FileNet BPM and IBM Content Foundation (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is a configurable option in FileNet Content Manager and FileNet BPM products. If using SSLv3 with these products, please refer to the sections below to...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FileNet Content Manager, IBM FileNet BPM and IBM Content Foundation products (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack affects products that use the SSL/TLS protocol as a means for secure communication. The IBM FileNet Content Manager, IBM FileNet BPM and IBM Content Foundation products can be configured to use the SSL/TLS protocol and are thus potentially affected by this...

File Upload Vulnerability in Collaborative Office Platform of Microsoft Technology (Hangzhou) Co.

Microsoft Technology Hangzhou Co., Ltd. is a professional ECM Collaboration Management Software and BPM Business Process Management Software R & D and solution provider. A file upload vulnerability exists in the Collaboration Office platform of Microhome Software Technology Hangzhou Co., Ltd, whi...

SQL Injection Vulnerability in Jeecg Boot of Beijing National Torch Information Technology Co. Ltd (CNVD-2021-47665)

Jeecg Boot is a low-code BPM-based platform. A SQL injection vulnerability exists in JeecgBoot of Beijing National Torch Information Technology Co. Ltd, which can be exploited by an attacker to obtain sensitive information from a database...

VulnCheck KEV: CVE-2016-9563

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity XXE attacks...

Unauthorized Access Vulnerability in AGILE-BPM Process Management Platform

Shenzhen Dasi Tongzhou Information Technology Co., Ltd. is a company that focuses on the implementation of enterprise process, according to the customer's own situation to provide the most reasonable process solutions. An unauthorized access vulnerability exists in AGILE-BPM process management...

CVE-2021-23272

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

CVE-2021-23272

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

Cross site scripting

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

CVE-2021-23272

CVE-2021-23272 affects TIBCO BPM Enterprise (versions 4.3.0 and below) and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric (versions 4.3.0 and below). The vulnerability is in the Application Development Clients component and can enable a Cross Site Scripting (XSS) attack by a low-privil...

CVE-2021-23272 TIBCO BPM Cross Site Scripting (XSS)

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...