CVE-2021-38893

CVE-2021-38893 affects IBM BPM 8.5/8.6 and IBM Business Automation Workflow 18.0–21.0, with a stored Cross‑Site Scripting (XSS) in the Web UI that could lead to credentials disclosure in a trusted session. Connected IBM advisories confirm affected products/versions and provide remediation guidanc...

Security Bulletin: Log4j - CVE-2021-44228 vulnerability affects IBM Cloud Pak for Business Automation(CP4BA) Workflow Process Service

Summary Log4j CVE-2021-44228 also called Log4Shell or LogJam affected the CP4BA Workflow Process Service. Customers are encouraged to take action and apply the fix below. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code ...

Unspecified Vulnerability in IBM Business Automation Workflow (CNVD-2021-102796)

IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. A security vulnerability exists in IBM Business Automation Workflow that stems fr...

IBM Business Automation Workflow Cross-Site Scripting Vulnerability (CNVD-2022-15537)

IBM Business Automation Workflow is a workflow automation solution from IBM USA. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability.IBM Business Automation Workflow has a security vulnerability that stems from the...

PT-2021-22313

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Automation Workflow versions 18.0 through 21.0 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

PT-2021-22316

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Automation Workflow versions 18.0 through 21.0 Description The issue allows a privileged user to obtain highly sensitive information due to improper access controls...

CVE-2021-38900: Undefined Security Weakness

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

CVE-2021-38893: Improper Neutralization of Input During Web Page Generation

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Security Bulletin: vulnerability affect IBM Cloud Pak for Business Automation Workflow Process Service (CVE-2021-38900)

Summary IBM Cloud Pak for Business Automaion Workflow Process Service could allow a privileged user to obtain highly sensitive information due to improper access controls. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Automation Workflow could allow a privileged user to...

IBM Business Automation Workflow 跨站脚本漏洞

IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. A cross-site scripting vulnerability exists in IBM Business Automation Workflow,...

CVE-2021-38893

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38900

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607...

IBM Business Automation Workflow Cross-Site Scripting Vulnerability (CNVD-2021-101696)

IBM Business Automation Workflow is a workflow automation solution from IBM Corporation of the United States. The product is primarily used for workflow management, compliance management, and has features such as workflow visibility and scalability.IBM Business Automation Workflow has a cross-sit...

Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow -CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090

Summary The embedded IBM Content Navigator component, that is shipped with IBM Business Automation Workflow is vulnerable to multiple vulnerabilities. Vulnerability Details CVEID: CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out-of-memory...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Cross site scripting

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2021-38883

CVE-2021-38883 affects IBM Business Automation Workflow (versions 18.0.0.x, 19.0.0.x, 20.0.0.x, 21.0.x) and IBM Business Process Manager (8.5.x, 8.6.x). Root cause: cross-site scripting via the Web UI due to lack of sufficient data validation/filtering of user-supplied data during the file upload...

Security Bulletin: Apache Log4j vulnerability affects IBM Business Automation Workflow (CVE-2021-44228)

Summary Process Federation Server PFS, shipped with IBM Business Automation Workflow BAW, is vulnerable to a vulnerability caused by log4j. The vulnerability is included in the ElasticSearch client library used by PFS. The ElasticSearch vulnerable library was also shipped in offline documentation...