EUVD-2014-4721

Malware in sbrugna...

Authorization

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager BPM 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by...

CVE-2014-4802

IBM BPM Saved Search Admin in Process Admin Console (BPM 8.0–8.5.5) suffers an authorization vulnerability: authenticated users can obtain unfiltered result sets from saved searches, potentially exposing tasks and instances that they are not permitted to see. The weakness arises in the Saved Sear...