Cross site scripting

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

CVE-2021-23272

CVE-2021-23272 affects TIBCO BPM Enterprise (versions 4.3.0 and below) and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric (versions 4.3.0 and below). The vulnerability is in the Application Development Clients component and can enable a Cross Site Scripting (XSS) attack by a low-privil...

CVE-2021-23272 TIBCO BPM Cross Site Scripting (XSS)

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

CVE-2021-23272

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting XSS attack o...

SQL Injection Vulnerability in BPM Business System of Shanghai Yizheng Information Technology Co.

Ltd. was founded in January 2008, specializing in providing enterprise customers with BPM Business Process Management system development, sales and customized business process management solution services. A SQL injection vulnerability exists in the BPM business system of Shanghai Yizheng...

Micrium Tibco BPM Enterprise Cross-Site Scripting Vulnerability

Tibco BPM Enterprise is a business process management platform from Tibco USA. The platform enables companies to drive digital transformation by making better decisions and acting faster and smarter. TIBCO Software Inc. A cross-site scripting vulnerability exists in TIBCO BPM Enterprise and TIBCO...

TIBCO Security Advisory: January 26, 2021 - TIBCO BPMEnterprise

TIBCO BPM Cross Site Scripting XSS Original release date: January 26, 2021 Lastrevised: CVE-2021-23272 Source: TIBCO SoftwareInc. TIBCO BPM Cross Site Scripting XSS Original release date: January 26, 2021 Last revised: --- Source: TIBCO Software Inc. Systems Affected TIBCO BPM Enterprise versions...

Logic Flaw Vulnerability in FlowPortal BPM Business System of Shanghai Yi Zheng Information Technology Co.

FlowPortal BPM is a business process system from Shanghai Ezine Information Technology Co. A logic flaw vulnerability exists in the FlowPortal BPM business system of Shanghai Yizheng Information Technology Co. Ltd. that can be exploited by an attacker to construct any user's identity information ...

The vulnerability of the Report Generator component in applications for creating reports with the TIBCO JasperReports Library, JasperReports Library for ActiveMatrix BPM, JasperReports Server, JasperReports Server for AWS Marketplace, and JasperReports Server for ActiveMatrix BPM allows attackers to escalate their privileges.

The vulnerability of the Report Generator component in applications for creating reports, such as the TIBCO JasperReports Library, JasperReports Library for ActiveMatrix BPM, JasperReports Server, JasperReports Server for AWS Marketplace, and JasperReports Server for ActiveMatrix BPM, is related ...

CVE-2020-4530

IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

Unspecified vulnerability in Venki Supravizio BPM

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 10.1.2. An attacker could exploit the vulnerability to determine if a username is valid and then conduct a brute force attack using a valid username...

Unspecified vulnerability in Venki Supravizio BPM (CNVD-2021-17753)

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 10.1.2, which stems from the program not limiting the number of authentication attempts. An attacker can use this vulnerability to conduct brute force...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

Design/Logic Flaw

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

Authentication flaw

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15367

CVE-2020-15367 affects Venki Supravizio BPM 10.1.2 and stems from not limiting authentication attempts on the Login page. This unbounded brute-force risk is evidenced by multiple sources noting an unauthenticated attacker could repeatedly attempt logins. The publicly available materials describe ...

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15392

CVE-2020-15392 — A user enumeration vulnerability in Venki Supravizio BPM 10.1.2 is triggered during password recovery. The issue arises from differing error messages that let an attacker determine whether a username exists, enabling brute-force use of valid usernames. Connected documents corrobo...