Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to Node.js runtime and to other component specific vulnerabilities. Vulnerability Details CVEID: CVE-2020-8265 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TL...

Security Bulletin: Multiple vulnerabilities in node.js may affect configuration editor used in IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-1971, CVE-2020-8265, CVE-2020-8287

Summary Security vulnerabilities have been reported for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable t...

CVE-2021-20626

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

CVE-2021-20626

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

CVE-2021-20626

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

CVE-2021-20626

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

CVE-2021-20626

CVE-2021-20626 affects Cybozu Office 10.0.0–10.8.4. Description: Improper access control in the Workflow module may allow an authenticated user to bypass access restrictions and alter workflow data via unspecified vectors. Impact: unauthorized data alteration within Workflow for logged-in users. ...

CVE-2021-20626: Undefined Security Weakness

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

PT-2021-14087

Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to an improper access control vulnerability in the Workflow of Cybozu Office, allowing authenticated attackers to bypass access restrictions and alter Workflow dat...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Cybozu Office Operation Restriction Bypass Vulnerability (CNVD-2021-18064)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operational restriction bypass vulnerability exists in the workflow in Cybozu Office. An attacker could exploit the vulnerability to alter workflow data without proper privileges...

How to Protect Your Downstream Workflows

Learn how to protect your downstream workflows without interruption...

Multiple vulnerabilities in Cybozu Office

Overview Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1657 Operational restrictions bypass vulnerability in Scheduler CWE-264 - CVE-2021-20624 CyVDB-1727 Operational restrictions bypass vulnerability in Bulletin Board CWE-264 - CVE-2021-20625...

Cybozu Office 安全漏洞

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operational restriction bypass vulnerability exists in the workflow in Cybozu Office. An attacker could exploit the vulnerability to alter workflow data without proper privileges...

Logic Flaw Vulnerability in Galloping Workflow Engine CCBMP Workflow Management System, Process Designer System

Jinan Chidori Information Technology Co., Ltd. specializes in process engine form engine research and development and innovation. A logic flaw vulnerability exists in the workflow engine CCBMP workflow management system and process designer system. An attacker can utilize the vulnerability to...

Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow - CVE-2020-4687, CVE-2020-4760, CVE-2020-4704

Summary The embedded IBM Content Navigator, that is shipped with IBM Business Automation Workflow is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2020-13956 DESCRIPTION: Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by...

Security Bulletin: Information leakage vulnerability affect IBM Business Automation Workflow - CVE-2021-20358

Summary IBM Business Automation Workflow may leak sensitive information in trace when emitting events for Business Automation Insights. Vulnerability Details CVEID: CVE-2021-20358 DESCRIPTION: IBM Business Automation Insights stores potentially sensitive information in clear text in API connectio...

IBM Engineering Workflow Management Cross-Site Scripting Vulnerability (CNVD-2021-14750)

IBM Engineering Workflow Management EWM is a team collaboration tool that integrates a variety of development tasks, including iteration planning, process definition, change management, defect tracking, source code control, build automation, and reporting. A cross-site scripting vulnerability...

PT-2021-3204

Name of the Vulnerable Software and Affected Versions LOTCMAN:PLM affected versions not specified Description The issue is related to an unlimited file upload vulnerability in the database update module of the WorkFlow system, which can allow an attacker to execute arbitrary code by replacing the...

PT-2021-3209

Name of the Vulnerable Software and Affected Versions LOTCMAN:PLM affected versions not specified Description The issue is related to a module for creating, editing, and saving scheme types of typical and working business processes, defining business process properties, and creating lists of...