IBM Business Process Manager授权绕过漏洞

Bugtraq ID:66679 CVE ID:CVE-2014-0908 IBM Business Process Manager是一款不断积累数据的有状态产品。 IBM Business Process Manager中的User属性功能没有授权概念，允许用户每个用户读取和更新自身的属性值及使用REST API来读取其他用户的值，可导致敏感信息泄漏。 0 IBM Business Process Manager Standard V7.5.x, 8.0.x, 8.5.x IBM Business Process Manager Express V7.5.x, 8.0.x, 8.5.x...

IBM Business Process Manager - User Account Reconfiguration

Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.1.1 newest versions can also be vulnerable Vulnerability...

IBM Business Process Manager - User Account Reconfiguration

IBM Business Process Manager - User Account Reconfiguration Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version:...

CVE-2013-6746

Cross-site scripting XSS vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers to inject arbitrary w...

Cross site scripting

Cross-site scripting XSS vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers to inject arbitrary w...

CVE-2013-6746

CVE-2013-6746 is an XSS vulnerability in IBM FileNet P8 Platform Documentation Installable Info Center shipped with IBM FileNet BPM, Content Manager, and Case Foundation. Affected components/versions include FileNet P8 Platform Documentation Installable Info Center 4.5.1–5.2.0, with IBM BPM 4.5.1...

Oracle BPEL Process Manager ScriptServlet Information Disclosure (CVE-2013-3828)

A directory traversal vulnerability has been reported in Oracle BPEL Process Manager. The vulnerability is due to insufficient input validation in ScriptServlet when processing HTTP request parameters. A remote unauthenticated attacker can leverage this vulnerability to obtain sensitive informati...

Oracle BPEL Process Manager ScriptServlet Remote Code Execution Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Oracle BPEL Process Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ScriptServlet. It suffers of a directory traversal vulnerability...

CVE-2013-0581

Multiple cross-site scripting XSS vulnerabilities in IBM Business Process Manager BPM 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving 1 ProcessPortal/jsp/socialPortal/dashboard.jsp, 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM Business Process Manager BPM 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving 1 ProcessPortal/jsp/socialPortal/dashboard.jsp, 2...

CVE-2013-0581

Multiple cross-site scripting XSS vulnerabilities in IBM Business Process Manager BPM 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving 1 ProcessPortal/jsp/socialPortal/dashboard.jsp, 2...

CVE-2013-0581

CVE-2013-0581 (IBM BPM) affects IBM Business Process Manager Standard/Express/Advanced 7.5.1.x, 8.0.0.x, 8.0.1.x (before FP1). Root cause: multiple cross-site scripting (XSS) vulnerabilities enabling remote authenticated users to inject arbitrary web script or HTML via four vectors: ProcessPortal...

php security, bug fix and enhancement update

5.3.3-22 - php-xml provides php-xmlreader and php-xmlwriter 874987 - fix possible NULL derefence and buffer overflow 879179 - fix zend garbage collector 848186, 868375 5.3.3-21 - fix CVE reference in previous changelog entry 5.3.3-20 - remove reproducer from security fix for CVE-2012-0781 5.3.3-1...

DarkComet-RAT v4.2 fwb (Firewall bypass)

DarkComet-RAT v4.2 fwb Firewall bypass This version is firewall bypass it will inject to web browsers and bypass firewall rules. Targets are in this order : Firefox, Opera, Chrome, Safari, Internet Explorer and Explorer if all fails normally never then it runs normally. Notice now you can use...

DarkComet-RAT v4.2 fwb (Firewall bypass)

DarkComet-RAT v4.2 fwb Firewall bypass This version is firewall bypass it will inject to web browsers and bypass firewall rules. Targets are in this order : Firefox, Opera, Chrome, Safari, Internet Explorer and Explorer if all fails normally never then it runs normally. Notice now you can use...

CVE-2011-0884

Unspecified vulnerability in the Oracle BPEL Process Manager component in Oracle Fusion Middleware 11.1.1.3.0, 11.1.1.4.0, and 11.1.1.5.0 allows remote authenticated users to affect availability, related to BPEL Console...

Buffer overflow

Unspecified vulnerability in the Oracle BPEL Process Manager component in Oracle Fusion Middleware 11.1.1.3.0, 11.1.1.4.0, and 11.1.1.5.0 allows remote authenticated users to affect availability, related to BPEL Console...

CVE-2011-0884

Oracle Fusion Middleware; Oracle BPEL Process Manager (versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0) contains an unspecified vulnerability related to the BPEL Console that allows remote authenticated users to affect availability. The provided documents do not specify the exact vulnerability, explo...

CVE-2011-0884

Unspecified vulnerability in the Oracle BPEL Process Manager component in Oracle Fusion Middleware 11.1.1.3.0, 11.1.1.4.0, and 11.1.1.5.0 allows remote authenticated users to affect availability, related to BPEL Console...

PHP 5.3 < 5.3.6 Multiple Vulnerabilities

According to its banner, the version of PHP 5.3.x installed on the remote host is older than 5.3.6. - A NULL pointer can be dereferenced in the function 'zipnamelocate' when processing empty archives and can lead to application crashes or code execution. Exploitation requires the...