CVE-2014-4802

IBM BPM Saved Search Admin in Process Admin Console (BPM 8.0–8.5.5) suffers an authorization vulnerability: authenticated users can obtain unfiltered result sets from saved searches, potentially exposing tasks and instances that they are not permitted to see. The weakness arises in the Saved Sear...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 update

Red Hat JBoss BPM Suite 6.0.3, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2014-4758

IBM Business Process Manager BPM 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL...

Information disclosure

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager BPM 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Business Process Manager BPM 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file...

CVE-2014-3075

This CVE-2014-3075 entry concerns an XSS vulnerability in IBM BPM (Standard/Express/Advanced) 7.5.x–8.5.x and WebSphere Lombardi Edition 7.2.0.x. The root cause is insecure handling of uploaded files in the BPM document-management feature, which can allow a remote authenticated attacker to inject...

CVE-2014-4759

IBM BPM 8.5.x through 8.5.5 is affected by CVE-2014-4759 due to an Ajax service in the Content Management toolkit that allows authenticated users to perform a document-attachment search and read document properties, potentially exposing sensitive information. The vulnerability arises because quer...

CVE-2014-4758

CVE-2014-4758 affects IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x. The root cause is missing access restrictions on the callService URL, allowing authenticated remote users to send requests to internal services. The IBM Security Bulletin cites that ...

Xxe

callService.do in IBM Business Process Manager BPM 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...

CVE-2014-3087

IBM BPM and WebSphere Lombardi Edition are affected by CVE-2014-3087 due to an XXE flaw in callService.do that allows remote authenticated users to read arbitrary files through crafted XML data. Affected: IBM BPM Express/Standard/Advanced 7.5.x, 8.0.x, 8.5.0, 8.5.5; WebSphere Lombardi Edition 7.2...

CVE-2014-3076

CVE-2014-3076 affects IBM Business Process Manager (BPM) 8.5 to 8.5.5. An unprotected JSP diagnostic page can disclose potentially sensitive system information to unauthenticated users, enabling information disclosure. IBM’s Security Bulletin notes vulnerable editions: BPM Standard, Express, and ...

CVE-2014-0957

IBM WebSphere Lombardi Edition and IBM Business Process Manager are affected by a cross-site scripting (XSS) flaw due to improper validation of user-supplied input. A remote attacker can exploit this via a crafted URL to trigger an unhandled service failure and potentially access cookie-based cre...

ORACLE Business Process Management (Process Administrator) 5.7-6.0-10.3 - XSS

No description provided by source. |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | |...

BPM Studio Pro 4.2 HTTPD Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4198/info BPM Studio Pro is a shareware MP3 mixer and player. It runs on Microsoft Windows operating systems. BPM Studio Pro includes a HTTP server for managing the player via a web interface. The BPM Studio Pro HTTPD doe...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.2 update

Red Hat JBoss BPM Suite 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

CVE-2014-2947

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

Sql injection

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

Cross site scripting

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

CVE-2014-2947

Bizagi BPM Suite (all versions) contains a reflected XSS in Login.aspx exposed via the txtUsername parameter. CVE-2014-2947 affects Bizagi BPM Suite before 10.3, enabling remote attackers to inject arbitrary JavaScript/HTML in the victim’s browser. CERT/ENISA notes the vulnerability as XSS with a...