Information disclosure

IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680...

CVE-2017-1356

IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683...

CVE-2017-1353

IBM Atlas eDiscovery Process Management 6.0.3–6.0.3.5 is vulnerable to an information-disclosure issue where an authenticated attacker could obtain sensitive data when a user clicks unsafe third-party links. The root cause is that links with target="_blank" and no rel="noopener noreferrer" grant ...

CVE-2017-1356

Affected product: IBM Atlas eDiscovery Process Management. Vulnerability: SQL injection in versions 6.0.3 – 6.0.3.5 due to insufficient input filtering, enabling a remote attacker to view, add, modify, or delete data in the backend database. Root cause (as stated): vulnerability to SQL injection....

CVE-2017-1355

IBM Atlas eDiscovery Process Management stores sensitive information in URL parameters, enabling potential information disclosure via server logs, referrers, or browser history. Affected: 6.0.3 through 6.0.3.5. CVSS v3 base 3.7. Remediation: upgrade to 6.0.3 Fix Pack 6 (6.0.3 FP6).

CVE-2017-1354

The CVE-2017-1354 entry concerns IBM Atlas eDiscovery Process Management. A cross-site scripting (XSS) vulnerability affects Atlas eDiscovery Process Management 6.0.3 (specifically 6.0.3.0 to 6.0.3.5). The underlying issue allows an attacker to inject arbitrary JavaScript into the Web UI, potenti...

IBM Atlas eDiscovery Process Management Information Disclosure Vulnerability

IBM Atlas eDiscovery Process Management is a product within the Information Lifecycle Governance solution from IBM USA that is used to help attorneys, paralegals, and evidence supervisors rigorously and logically manage legal evidence retention workflows. An information disclosure vulnerability...

IBM Atlas eDiscovery Process Management SQL Injection Vulnerability

IBM Atlas eDiscovery Process Management is a product within the Information Lifecycle Governance solution from IBM USA that is used to help attorneys, paralegals, and evidence supervisors rigorously and logically manage legal evidence retention workflows. A SQL injection vulnerability exists in I...

Supervisor Remote Command Execution Vulnerability

Supervisor is a client/server system developed in Python that manages and monitors processes on UNIX-like operating systems. It can start and shut down multiple processes at the same time. A remote command execution vulnerability exists in Supervisor. It allows a remote user to execute arbitrary...

RedHat JBoss BRMS and BPM Suite HTML Injection Vulnerability

Red Hat JBoss BRMS is a comprehensive business process automation platform that integrates business rules management, business process management BPM and complex event processing CEP into a single open source solution. An HTML injection vulnerability exists in Red Hat JBoss BRMS and BPM Suite due...

RedHat JBoss BRMS and BPM Suite Cross-Site Scripting Vulnerability

RedHat JBoss BRMS is a comprehensive business process automation platform that integrates business rules management, business process management BPM and complex event processing CEP into a single open source solution. A cross-site scripting vulnerability exists in RedHat JBoss BRMS and BPM Suite...

CVE-2016-5401

Cross-site request forgery CSRF vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page...

util-linux: Sending SIGKILL to other processes with root privileges via su

A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions...

CentOS 6 : coreutils (CESA-2017:0654)

An update for coreutils is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Red Hat JBoss BPMS Cross-Site Scripting Vulnerability

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. A cross-site scripting vulnerability exists in R...

util-linux: Sending SIGKILL to other processes with root privileges via su

A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions...

SUSE-SU-2017:0553-1 Security update for util-linux

This update for util-linux fixes a number of bugs and two security issues. The following security bugs were fixed: - CVE-2016-5011: Infinite loop DoS in libblkid while parsing DOS partition bsc988361 - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to select...

CVE-2017-2616

A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions...

Stored XSS in business process editor

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before...

Multiple HTML Injection Vulnerabilities in Red Hat JBoss BPMS

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. Red Hat JBoss BPMS has multiple HTML injection vulnerabilities th...