7590 matches found
PT-2019-9963
Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.1 Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions fro...
PT-2019-9956
Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.2 Description The issue could reveal sensitive version information about the server from error pages, potentially aiding an attacker in further attacks against the system...
PT-2019-16859
Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and IBM Business Process Manager versions 18.0.0.0 through 18.0.0.2 Description The issue is related to a missing restriction in an API, which could allow a client to spoof the last modified by value of a...
PT-2019-9950
Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and Business Process Manager versions 18.0.0.0 through 18.0.0.2 Description The issue allows an authenticated attacker to potentially cause a denial of service by sending a specially crafted request that exhaus...
CVE-2018-2000: Cross-Site Request Forgery (CSRF)
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890...
CVE-2018-1999: Exposure of Sensitive Information to an Unauthorized Actor
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889...
CVE-2018-1885: Exposure of Sensitive Information to an Unauthorized Actor
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020...
CVE-2019-1003041
A flaw was found in the Jenkins Workflow CPS plugin. Groovy Plugins could be circumvented through methods supporting type casts and type coercion allowing attackers to invoke constructors for arbitrary types. The highest threat from this vulnerability is to data confidentiality and integrity as...
CVE-2019-1003030
A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...
How to Mature Your Threat Hunting Program with the ATT&CK™ Framework
John Wunder, Principal Cybersecurity Engineer at MITRE spoke in a recent webinar about how the ATT&CK framework is a knowledgebase of adversary behaviors, describing the things that are tough for the adversary to change – those at the top of David J. Bianco’s influential Pyramid of Pain. Wunder...
The vulnerability of the Workflow component of the Oracle PeopleSoft Enterprise PeopleTools business application package allows a perpetrator to gain unauthorized access to protected data.
The vulnerability of the Workflow component of the Oracle PeopleSoft Enterprise PeopleTools business application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP...
Rundeck Community Edition Cross Site Scripting
Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...
Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting
Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...
Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting Vulnerability
Exploit for java platform in category web applications Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...
Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting
Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...
nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)
org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...
nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)
org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...
SQL Injection Vulnerabilities Exist in Many Places in Yuanheng Times Workflow Engine System
Beijing Yuanheng Times Technology Co., Ltd. is the first full-service IT service provider in China to launch a collaboration management system based on Microsoft SharePoint platform. SQL injection vulnerability exists in many places in the workflow engine system of Yuanheng Times, which can be...
SugarCRM WorkFlow PHP Code Injection Vulnerability
SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...
Fedora 29 : php-symfony4 (2018-84a1f77d89)
Version 4.1.9 2018-12-06 - security CVE-2018-19790 Security\Http detect bad redirect targets using backslashes @xabbuh - security CVE-2018-19789 Form Filter file uploads out of regular form types @nicolas-grekas - bug 29436 Cache Fixed Memcached adapter doClearto call flush raitocz - bug 29441...