Communities and collections administrators can escalate their privilege up to system administrator

Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0,...

Cross-Site Request Forgery (CSRF) in tsolucio/corebos

Description Hey corebos team, in the meanwhile I find another low level CSRF. attacker can activate/deactivate a Task of workflow with CSRF attack. Proof of Concept // PoC.html history.pushState'', '', '/'...

CVE-2021-41189

CVE-2021-41189 affects DSpace 7.0; any community/collection administrator can escalate to system administrator due to a privilege elevation issue. The vulnerability is limited to 7.0 and is not present in 6.x or earlier. It is patched in 7.1. Workarounds in 7.0 include disabling community/collect...

Security Bulletin: Multiple vulnerabilites affect Engineering Lifecycle Management and IBM Engineering products.

Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Workflow Management EWM, IBM...

Vulnerability On-Demand Search Reporting & Easy Download options

Vulnerability reporting is different from any other aspect of a Vulnerability Management Program. The methodologies of Discover, Assess, Report and Remediate are critical components that should be included in the respective sections of a Vulnerability Report. Qualys VMDR Vulnerability Management...

IBM Business Automation Workflow Cross-Site Scripting Vulnerability (CNVD-2021-94166)

IBM Business Automation Workflow is a workflow automation solution. The product is mainly used for workflow management, compliance management, and has features such as workflow visibility and scalability. IBM Business Automation Workflow has a cross-site scripting vulnerability that can be...

CVE-2021-29835

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-29835

IBM Business Automation Workflow (IBM Cloud Pak for Business Automation) is affected by CVE-2021-29835: cross-site scripting in the Web UI for versions 18.0–21.0. The root cause is improper handling of UI input leading to JavaScript injection, with potential credential exposure in a trusted sessi...

CVE-2021-29835

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Security Bulletin: Cross-Site scripting vulnerability affect IBM Business Automation Workflow - CVE-2021-29835

Summary IBM Business Automation Workflow are vulnerable to a Cross Site Scripting attack. Vulnerability Details CVEID: CVE-2021-29835 DESCRIPTION: IBM Business Automation Workflow and IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed...

IBM Business Process Manager和IBM Business Automation Workflow 跨站脚本漏洞

IBM Business Automation Workflow is a workflow automation solution. The product is mainly used for workflow management, compliance management, and has features such as workflow visibility and scalability. IBM Business Automation Workflow has a cross-site scripting vulnerability that can be...

Microsoft SharePoint Workflow Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of custom workflows. The issue results from the lack of proper validation ...

Design/Logic Flaw

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.6-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping...

CVE-2021-35563

CVE-2021-35563 affects Oracle Shipping Execution in Oracle E-Business Suite (component: Workflow Events). Affected versions: 12.2.6–12.2.10. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise data, enabling unauthorized creation, deletion, or modificati...

IBM Business Automation Workflow Cross-Site Scripting Vulnerability

IBM Business Automation Workflow is a workflow automation solution from IBM Corporation. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability.IBM Business Automation Workflow suffers from a cross-site scripting vulnerabilit...

CVE-2021-29878

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-29878

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-29878

IBM BUSINESS AUTOMATION WORKFLOW is affected by CVE-2021-29878, a cross-site scripting vulnerability in Case Builder within Workflow Center. The issue stems from insufficient validation/escaping of user-supplied parameters in the Web UI, enabling an attacker to embed arbitrary JavaScript and pote...