CVE-2014-2947

Cross-site scripting XSS vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter...

CVE-2014-2948

Bizagi BPM Suite (workflowenginesoa.asmx) is affected by CVE-2014-2948, a SQL injection vulnerability reported to allow a remote authenticated attacker to execute arbitrary SQL via a crafted SOAP request. The issue targets the workflowenginesoa.asmx web service and is described alongside an addit...

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request...

Bizagi BPM Suite contains multiple vulnerabilities

Overview Bizagi BPM Suite contains a reflected cross-site scripting vulnerability and a SQL injection vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-2947According to Open-Sec consultant Mauricio Urizar, all versions...

Authorization

The User Attribute implementation in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information,...

CVE-2014-0908

IBM BPM's User Attribute feature (Standard/Express/Advanced) across 7.5.x, 8.0.x, 8.5.x does not enforce authorization for read/write of attribute values via REST, enabling remote authenticated users to read or modify attributes and affect email notifications or task assignments. Affected version...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468

CVE-2013-6468 affects JBoss Drools and Red Hat JBoss BRMS/BPM Suite prior to 6.0.1. The flaw allows remote authenticated users to execute arbitrary Java code via MVFLEX (MVEL) or Drools expressions, caused by unsafe expression handling. Red Hat advisories RHSA-2014:0371/0372 document the fix in B...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update

Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2013-5452

IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2013-0581

CVE-2013-0581 (IBM BPM) affects IBM Business Process Manager Standard/Express/Advanced 7.5.1.x, 8.0.0.x, 8.0.1.x (before FP1). Root cause: multiple cross-site scripting (XSS) vulnerabilities enabling remote authenticated users to inject arbitrary web script or HTML via four vectors: ProcessPortal...

CVE-2012-0688

Cross-site scripting XSS vulnerability in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to inject arbitra...

CVE-2012-0689

The server in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to discover credentials via unspecified vecto...

Design/Logic Flaw

The server in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to discover credentials via unspecified vecto...

Code injection

TIBCO ActiveMatrix Runtime Platform in Service Grid and Service Bus 2.x before 2.3.2 and BusinessWorks Service Engine before 5.8.2; TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service...

BPM Database leaked by p0keu for #AntiSec

BPM Database leaked by p0keu for AntiSec One more Hacker with name "p0keu" leak the database of BPM https://visitbpm.co.uk for Antisec. BPM is the world's largest event dedicated to DJing, electronic music production and club culture has had its whole database leaked via twitter. The database is...

BPM Database leaked by p0keu for #AntiSec

BPM Database leaked by p0keu for AntiSec One more Hacker with name "p0keu" leak the database of BPM https://visitbpm.co.uk for Antisec. BPM is the world's largest event dedicated to DJing, electronic music production and club culture has had its whole database leaked via twitter. The database is...

CVE-2011-1046

CVE-2011-1046 : IBM FileNet P8 Content Engine (P8CE) versions 4.0.1–5.0.0 (used in FileNet P8 CM and BPM) do not require the PRIVILEGED_WRITE access role for all intended Object Store modifications, allowing remote attackers to change a privileged property of an object through unspecified vectors...

Oracle Business Process Management Detection

The remote web server is running Oracle formerly BEA Business Process Management BPM Suite, a set of tools for creating, executing, and optimizing business processes. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid48338; scriptversion"1.8"; scriptcvsdate"Date:...