Tangro Business Workflow Security Vulnerability

Tangro Business Workflow is a software from Tangro Germany that visualizes the internal control and approval processes of SAP document content. A security vulnerability exists in tangro Business Workflow before 1.18.1, which originates from the generation of the same JWT token at every login, whi...

Tangro Business Workflow 授权问题漏洞

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A vulnerability exists in Tangro Business Workflow prior to version 1.18.1 due to an authorization issue, which stems from the...

Tangro Business Workflow 代码问题漏洞

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A code issue vulnerability exists in tangro Business Workflow versions prior to 1.18.1, which stems from requesting a list of...

PT-2020-16333

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows unauthorized access to download workitem attachments by knowing the attachment ID, without requiring authentication. Recommendations For versions prior to 1.18.1,...

Tangro Business Workflow 授权问题漏洞

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A security vulnerability exists in Tangro Business Workflow versions prior to 1.18.1, which can be exploited by an attacker to...

PT-2020-16332

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue arises from the fact that certain restrictions on editing a user's profile are only applied on the client-side, allowing manipulation of greyed-out values in requests to t...

CVE-2020-26172: Authentication Bypass by Capture-replay

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp...

CVE-2020-26177: Incorrect Resource Transfer Between Spheres

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

CVE-2020-26178: Authorization Bypass Through User-Controlled Key

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated...

CVE-2020-26173: Missing Authentication for Critical Function

An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents PDF by providing a valid document ID and token. No further authentication is required...

CVE-2020-26175: Authorization Bypass Through User-Controlled Key

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users...

CVE-2020-26176: Insecure Storage of Sensitive Information

An issue was discovered in tangro Business Workflow before 1.18.1. No or broken access control checks exist on the /api/document/ /attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to...

CVE-2020-26171: Authorization Bypass Through User-Controlled Key

In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them...

PT-2020-16327

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows an attacker to reuse a JWT token when a session is active because every login generates the same JWT token. This token does not contain an expiration timestamp,...

PT-2020-16331

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description An issue exists where no or broken access control checks are in place on the "/api/document//attachments" API endpoint. This allows an attacker, knowing a document ID, to list all...

PT-2020-16326

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows users to manipulate the documentId of attachment uploads to the "/api/document/attachments/upload" API endpoint. This manipulation enables users to add attachments ...

PT-2020-16329

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1 Description The issue allows an attacker to upload any file as an attachment to a workitem, despite restrictions on filetypes. This is because the restriction is enforced in the browser, which...

PT-2020-16328

Name of the Vulnerable Software and Affected Versions Tangro Business Workflow versions prior to 1.18.1 Description The issue is related to an incorrect access control implementation, allowing an attacker to download documents, specifically PDFs, by providing a valid document ID and token without...

CVE-2020-4794

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force...

IBM多款产品授权问题漏洞

IBM Business Process Manager BPM and so on are products of IBM Corporation in the U.S. IBM Business Process Manager is a set of integrated business process management platform.IBM Business Automation Workflow is a set of workflow automation solutions. IBM Process Federation Server Component is an...