CVE-2015-7463

IBM Business Process Manager versions 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 up to cumulative fix 2 suffer an authorization flaw that allows remote authenticated users to delete process and task data by bypassing proper authorization checks. Root cause: insufficient authorization for delete oper...

CVE-2015-3898

Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to 1 bonita/login.jsp or 2 bonita/loginservice...

Open redirect

Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to 1 bonita/login.jsp or 2 bonita/loginservice...

CVE-2015-3898

CVE-2015-3898 refers to open redirect vulnerabilities in Bonita BPM Portal prior to 6.5.3. The flaw allows remote attackers to redirect users to arbitrary sites via the redirectUrl parameter on the login flow (bonita/login.jsp and bonita/loginservice). The connected documents confirm the vulnerab...

CVE-2015-3898

Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to 1 bonita/login.jsp or 2 bonita/loginservice...

Dashbuilder: insecure handling of CSRF token

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web...

Dashbuilder: Reflected XSS

JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder usually admins to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of...

CVE-2017-1494

CVE-2017-1494 pertains to a cross-site scripting (XSS) vulnerability in IBM BPM/Process Designer web UI. Connected IBM bulletin entries confirm the flaw allows injection of JavaScript into the Web UI, potentially exposing credentials within a trusted session. Affected products/versions include IB...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.7 security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Authorization

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

CVE-2017-5532

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy...

UBUNTU-CVE-2017-5532

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy...

CVE-2017-5533 TIBCO JasperReports Server credentials disclosure

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability whic...

Input validation

Red Hat JBoss A-MQ 6.x; BPM Suite BPMS 6.x; BRMS 6.x and 5.x; Data Grid JDG 6.x; Data Virtualization JDV 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works FSW 6.x; Operations Network JBoss ON 3.x; Portal 6.x; SOA Platform SOA-P 5.x; Web Server JWS 3.x;...

CVE-2015-7501

Red Hat JBoss A-MQ 6.x; BPM Suite BPMS 6.x; BRMS 6.x and 5.x; Data Grid JDG 6.x; Data Virtualization JDV 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works FSW 6.x; Operations Network JBoss ON 3.x; Portal 6.x; SOA Platform SOA-P 5.x; Web Server JWS 3.x;...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.6 security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

CVE-2017-1539

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1527

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156...

CVE-2017-1530

CVE-2017-1530 is a cross-site scripting vulnerability in IBM Business Process Manager (BPM) Process Admin Console. The IBM bulletin lists affected versions: BPM 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8.5.0.2, 8.5.5.0, 8.5.6.0 CF2, and 8.5.7.0 with CF 2017.06. The vulnerability could allow an a...

CVE-2017-1531

IBM Business Process Manager versions 7.5, 8.0, and 8.5 are described as vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript injection and potentially leading to credential disclosure within a trusted session. The connected documents confirm the affected product and t...