CVE-2014-8125

CVE-2014-8125 is an XXE vulnerability in Drools and jBPM that, before version 6.2.0, allows remote attackers to read arbitrary files via a crafted BPMN2 file. Affected: Drools/jBPM runtimes; root cause: XML External Entity processing in BPMN2 handling. Impact per sources: potential file disclosur...

CVE-2017-7545

CVE-2017-7545 affects jbpmmigration 6.5, where XmlUtils expands external parameter entities while parsing XML, enabling a remote attacker to read files accessible to the application server user and potentially conduct further XXE attacks. The GHSA and OSV entries corroborate XML External Entity R...

CVE-2021-20306

CVE-2021-20306 affects the jBPM BPMN editor (version 7.51.0.Final). The vulnerability allows any authenticated user from any project to see the names of Ruleflow Groups in other projects, exposing project confidentiality. The issue is rooted in cross-project visibility within the BPMN editor; no ...

CVE-2013-6465

CVE-2013-6465 : Multiple cross-site scripting (XSS) vulnerabilities exist in JBPM KIE Workbench 6.0.x. The issues allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name inputs. Sources in connected documents (NVD/CNVD/PRION/CVE entries) consistent...