Information disclosure

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager BPM 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results...

CVE-2014-4758

CVE-2014-4758 affects IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x. The root cause is missing access restrictions on the callService URL, allowing authenticated remote users to send requests to internal services. The IBM Security Bulletin cites that ...

CVE-2014-3075

This CVE-2014-3075 entry concerns an XSS vulnerability in IBM BPM (Standard/Express/Advanced) 7.5.x–8.5.x and WebSphere Lombardi Edition 7.2.0.x. The root cause is insecure handling of uploaded files in the BPM document-management feature, which can allow a remote authenticated attacker to inject...

CVE-2014-4759

IBM BPM 8.5.x through 8.5.5 is affected by CVE-2014-4759 due to an Ajax service in the Content Management toolkit that allows authenticated users to perform a document-attachment search and read document properties, potentially exposing sensitive information. The vulnerability arises because quer...

Xxe

callService.do in IBM Business Process Manager BPM 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...

CVE-2014-3087

IBM BPM and WebSphere Lombardi Edition are affected by CVE-2014-3087 due to an XXE flaw in callService.do that allows remote authenticated users to read arbitrary files through crafted XML data. Affected: IBM BPM Express/Standard/Advanced 7.5.x, 8.0.x, 8.5.0, 8.5.5; WebSphere Lombardi Edition 7.2...

CVE-2014-3076

CVE-2014-3076 affects IBM Business Process Manager (BPM) 8.5 to 8.5.5. An unprotected JSP diagnostic page can disclose potentially sensitive system information to unauthenticated users, enabling information disclosure. IBM’s Security Bulletin notes vulnerable editions: BPM Standard, Express, and ...

CVE-2014-0957

IBM WebSphere Lombardi Edition and IBM Business Process Manager are affected by a cross-site scripting (XSS) flaw due to improper validation of user-supplied input. A remote attacker can exploit this via a crafted URL to trigger an unhandled service failure and potentially access cookie-based cre...

BPM Studio Pro 4.2 HTTPD Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4198/info BPM Studio Pro is a shareware MP3 mixer and player. It runs on Microsoft Windows operating systems. BPM Studio Pro includes a HTTP server for managing the player via a web interface. The BPM Studio Pro HTTPD doe...

ORACLE Business Process Management (Process Administrator) 5.7-6.0-10.3 - XSS

No description provided by source. |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | |...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.2 update

Red Hat JBoss BPM Suite 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2947

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

Sql injection

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

Cross site scripting

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

CVE-2014-2947

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2948

Bizagi BPM Suite (workflowenginesoa.asmx) is affected by CVE-2014-2948, a SQL injection vulnerability reported to allow a remote authenticated attacker to execute arbitrary SQL via a crafted SOAP request. The issue targets the workflowenginesoa.asmx web service and is described alongside an addit...

CVE-2014-2947

Bizagi BPM Suite (all versions) contains a reflected XSS in Login.aspx exposed via the txtUsername parameter. CVE-2014-2947 affects Bizagi BPM Suite before 10.3, enabling remote attackers to inject arbitrary JavaScript/HTML in the victim’s browser. CERT/ENISA notes the vulnerability as XSS with a...

Bizagi BPM Suite contains multiple vulnerabilities

Overview Bizagi BPM Suite contains a reflected cross-site scripting vulnerability and a SQL injection vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-2947According to Open-Sec consultant Mauricio Urizar, all versions...