CVE-2016-6344

CVE-2016-6344 affects Red Hat JBoss BRMS 6 and Red Hat JBoss BPM Suite 6, where HttpOnly flags are not set on session cookies. This exposes cookies to access via client-side scripts (XSS), enabling potential information disclosure. Red Hat RHSA-2017:0248/0249 documents a security update for BRMS/...

CVE-2016-7034

CVE-2016-7034 concerns the dashbuilder component of Red Hat JBoss BPM Suite 6.x, where CSRF tokens generated during an active session are included in query strings. The underlying issue allows bypassing CSRF protections or performing CSRF attacks using old tokens. Red Hat advisories RHSA-2017:055...

CVE-2016-7034

It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web...

CVE-2016-7033

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via dashbuilder. Remote, authenticated attackers that have privileges to access dashbuilder usually admins can store scripts in several editable fields, which are not properly sanitized before showing to other users, including other admi...

SAP NetWeaver AS JAVA - XXE vulnerability in BC-BMT-BPM-DSK component (CVE-2016-9563)

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.5 Vendor URL: SAP Bugs: XXE Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XXE...

CVE-2016-6344

It was discovered that JBoss BRMS 6 and BPM Suite 6 are not setting HttpOnly flags on sensitive cookies. Remote attackers can access these cookies by using client-side scripts, usually through XSS...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.3.2 security and bug fix update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Red Hat JBoss BPM Suite Cross-Site Request Forgery Vulnerability

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. A cross-site request forgery vulnerability exist...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.3.1 security and bug fix update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

CVE-2016-0349

IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call...

CVE-2016-0349

CVE-2016-0349 affects IBM Business Process Manager versions 8.5.6–8.5.6.2 and 8.5.7 before 8.5.7.CF201606. The issue is an incorrect authorization check that allows remote authenticated users to bypass access controls and update process-instance variables via a REST API call. Impact is restricted...

CVE-2016-0349

IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call...

Critical: Red Hat Security Advisory: Red Hat JBoss BPM Suite security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Unspecified Vulnerability in Red Hat JBoss BPM Suite

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. A security vulnerability exists in Red Hat JBoss...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite security and bug fix update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

ProcessMaker 3.0.1.7 - Multiple Vulnerabilities

ProcessMaker 3.0.1.7 - Multiple Vulnerabilities Exploit Title: ProcessMaker v3.0.1.7 Multiple vulnerabilities Date: 31/05/2016 Author: Mickael Dorigny @ information-security.fr Vendor or Software Link: http://www.processmaker.com/ Version: 3.0.1.7 Category: Multiple Vulnerabilities ProcessMaker...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.2 update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

PT-2016-3362 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA version 7.5 Description: The issue is related to an XML External Entity XXE vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA. This vulnerability allows remote authenticated users to conduct XXE...

Cross site scripting

Cross-site scripting XSS vulnerability in the document-list control implementation in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-0227

CVE-2016-0227 affects IBM Business Process Manager (BPM) document-list control. The vulnerability arises from insufficient input escaping, enabling cross-site scripting via a specially crafted URL. Affected BPM versions include 8.0 (to 8.0.1.3), 8.5.0 (to 8.5.0.2), 8.5.5, and 8.5.6 (to 8.5.6.2). ...