918 matches found
Security Bulletin: IBM WebSphere Lombardi Edition and IBM Business Process Manager (BPM) cross-site scripting vulnerability in error situations (CVE-2014-0957)
Summary When you invoke a service using a URL, user input can be returned in unhandled service failure situations. Vulnerability Details CVE ID: CVE-2014-0957 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager are vulnerable to cross-site scripting that is caused by the...
Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) and Denial Of Service vulnerability in Apache Commons FileUpload (CVE-2014-0050) affect IBM Business Process Manager (BPM) V8.5.5.0
Summary Security vulnerabilities have been reported for the Apache Struts 1.1 and Apache Commons FileUpload libraries shipped with one component of IBM Business Process Manager V8.5.5. Vulnerability Details The vulnerable libraries are used only in an administrative user interface that, by defaul...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server which is shipped with IBM WebSphere Process Server and IBM Business Process Manager (IBM SDK for Java CPU April 2014)
Summary IBM WebSphere Application Server is shipped as a component of IBM WebSphere Process Server and IBM Business Process Manager. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For...
Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) affects WebSphere Lombardi Edition and IBM Business Process Manager (BPM)
Summary There is a class loader manipulation vulnerability in Apache Struts CVE-2014-0114 that affects WebSphere Lombardi Edition and IBM Business Process Manager. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts 1.X might allow a remote attacker to execute arbitrary code on...
Security Bulletin: Denial of Service vulnerability in Apache Commons FileUpload affects IBM Business Process Manager (BPM)
Summary A security vulnerability exists in the open source library Apache Commons FileUpload that is shipped with, and used by, the IBM Business Process Manager products. Vulnerability Details By sending a specially crafted request, an attacker might exploit this vulnerability to cause the...
Security Bulletin: Missing authorization concept for IBM Business Process Manager (BPM) User Attributes CVE-2014-0908
Summary The User Attribute feature in IBM Business Process Manager does not have an authorization concept. Vulnerability Details As a consequence, each user can read and update their own attribute values and the attribute values for another user by using REST APIs. However, there are...
Incorrect Access Control in Phusion Passenger
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates a...
Quest NetVault Backup NVBUEventHistory Get Method SQL Injection (CVE-2017-17412)
An SQL injection vulnerability exists in the Server Process Manager Service of Quest NetVault Backup. The vulnerability is due to improper validation of user-supplied input on JSON-RPC requests invoking the Get method of the NVBUEventHistory class...
IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2018-07654)
IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM B...
IBM Business Process Manager Information Disclosure Vulnerability (CNVD-2018-08192)
IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A security vulnerability exists in IBM BPM version...
IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2018-07655)
IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM B...
IBM Business Process Manager Information Disclosure Vulnerability (CNVD-2018-08191)
IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A security vulnerability exists in IBM BPM version 8...
CVE-2018-1384
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135...
CVE-2017-1766
Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151...
CVE-2017-1767
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152...
Code injection
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856...
CVE-2017-1765
IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150...
CVE-2017-1767
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152...