CVE-2015-1884

IBM Business Process Manager (BPM) and WebSphere Lombardi Edition are affected by a directory traversal vulnerability (CVE-2015-1884) due to insufficient input validation in the internationalization-file URL. Vulnerable products/versions include BPM Standard/Express/Advanced 7.5.x–8.5.5.0 and WLE...

CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

Directory traversal

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

CVE-2015-3897

Bonita BPM Portal before 6.5.3 is affected by two concrete issues: (1) Local File Inclusion via themeResource when theme and location contain .., allowing reading arbitrary server files; (2) Open Redirect via redirectUrl parameter, enabling redirection to arbitrary sites after login. The NVD/Nucl...

CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

Bonita BPM < 6.5.3 Multiple Vulnerabilities

Bonita BPM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bonitasoft:bonitabpm"; if...

Bonita BPM Detection

Detection of Bonita BPM. The script sends a connection request to the server and attempts to detect Bonita BPM. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Arbitrary File Disclosure and Open Redirect in Bonita BPM

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Bonita BPM 6.5.1 - Multiple Vulnerabilities

Bonita BPM 6.5.1 - Multiple Vulnerabilities Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect Vulnerabilities

Exploit for php platform in category web applications Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch:...

Bonita BPM 6.5.1 - Multiple Vulnerabilities

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...

Bonita BPM Path Traversal Vulnerability

Bonita BPM is an open source business process management - workflow suite. A path traversal vulnerability exists in Bonita BPM. Since the input passed to the "bonita/portal/themeResource" URL via the "theme" and "location" HTTP GET parameters is not properly validated as part of the used filename...

CVE-2015-0193

CVE-2015-0193 : A cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) arises from improper neutralization of user-supplied input in certain error conditions, allowing remote authenticated users to inject arbitrary web script or HTML ...

CVE-2015-0156

CVE-2015-0156 is a stored XSS vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE). The root cause is improper validation of user-supplied input, allowing a remote authenticated attacker to craft a URL that executes arbitrary web script in the victim’s browser ...

Arbitrary File Disclosure and Open Redirect in Bonita BPM

High-Tech Bridge Security Research Lab two vulnerabilities in Bonita BPM Portal Bonita's web interface running by default on port 8080, which can be exploited by remote non-authenticated attacker to compromise the vulnerable web application and the web server on which it is hosted. 1 Path Travers...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 update

Red Hat JBoss BPM Suite 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

Cross site scripting

Cross-site scripting XSS vulnerability in the Coach NG framework in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0158

CVE-2015-0158 corresponds to a cross-site scripting (XSS) vulnerability in the IBM BPM Coach NG framework. The root cause is improper validation of user-supplied input, allowing a remote attacker to trigger script execution in a user’s browser via a specially crafted URL. Affected products includ...

CVE-2015-0103

Multiple cross-site scripting XSS vulnerabilities in the Process Portal in IBM Business Process Manager BPM 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields...