CVE-2015-3898

CVE-2015-3898 refers to open redirect vulnerabilities in Bonita BPM Portal prior to 6.5.3. The flaw allows remote attackers to redirect users to arbitrary sites via the redirectUrl parameter on the login flow (bonita/login.jsp and bonita/loginservice). The connected documents confirm the vulnerab...

Dashbuilder: Reflected XSS

JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder usually admins to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of...

Dashbuilder: insecure handling of CSRF token

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web...

CVE-2017-1494

CVE-2017-1494 pertains to a cross-site scripting (XSS) vulnerability in IBM BPM/Process Designer web UI. Connected IBM bulletin entries confirm the flaw allows injection of JavaScript into the Web UI, potentially exposing credentials within a trusted session. Affected products/versions include IB...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.7 security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Authorization

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

CVE-2017-5532

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy...

UBUNTU-CVE-2017-5532

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy...

CVE-2017-5533 TIBCO JasperReports Server credentials disclosure

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability whic...

Input validation

Red Hat JBoss A-MQ 6.x; BPM Suite BPMS 6.x; BRMS 6.x and 5.x; Data Grid JDG 6.x; Data Virtualization JDV 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works FSW 6.x; Operations Network JBoss ON 3.x; Portal 6.x; SOA Platform SOA-P 5.x; Web Server JWS 3.x;...

CVE-2015-7501

Red Hat JBoss A-MQ 6.x; BPM Suite BPMS 6.x; BRMS 6.x and 5.x; Data Grid JDG 6.x; Data Virtualization JDV 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works FSW 6.x; Operations Network JBoss ON 3.x; Portal 6.x; SOA Platform SOA-P 5.x; Web Server JWS 3.x;...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.6 security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

CVE-2017-1539

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1527

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156...

CVE-2017-1539

IBM BPM is affected by CVE-2017-1539 for privilege escalation caused by failing to distinguish internal group memberships from user registry group memberships; manipulating LDAP group membership can grant privileged access. Affected versions include BPM 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8...

CVE-2017-1531

IBM Business Process Manager versions 7.5, 8.0, and 8.5 are described as vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript injection and potentially leading to credential disclosure within a trusted session. The connected documents confirm the affected product and t...

CVE-2017-1527

IBM Business Process Manager (BPM) is affected by an XML External Entity (XXE) vulnerability (CVE-2017-1527). The issue stems from insufficient restriction of the XML parser when processing XML messages, potentially allowing an authenticated remote attacker to exfiltrate sensitive information or ...

CVE-2017-1530

CVE-2017-1530 is a cross-site scripting vulnerability in IBM Business Process Manager (BPM) Process Admin Console. The IBM bulletin lists affected versions: BPM 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8.5.0.2, 8.5.5.0, 8.5.6.0 CF2, and 8.5.7.0 with CF 2017.06. The vulnerability could allow an a...

CVE-2017-1346

IBM BPM CVE-2017-1346 affects IBM Business Process Manager versions 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8.5.0.2, 8.5.5.0, 8.5.6.0–8.5.6.0 CF2, and 8.5.7.x. The vulnerability arises because the product temporarily stores files in a temporary/shared directory during offline installs, which a ...

CVE-2017-1424

CVE-2017-1424 affects IBM Business Process Manager (BPM) 8.5.7.0 (including CF 2017.06) where the Web UI is vulnerable to cross-site scripting via HTML injection in the UI. The IBM Security Bulletin confirms an HTML injection vulnerability enabling arbitrary JavaScript in the browser session, wit...