Ibm Business Process Manager vulnerabilities

CVE-2021-39046 [MEDIUM] CWE-522 CVE-2021-39046: IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.

CVE-2014-6182 [MEDIUM] CWE-22 CVE-2014-6182: Directory traversal vulnerability in an export function in the Process Center in IBM Business Proces Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.

CVE-2014-3087 [MEDIUM] CWE-200 CVE-2014-3087: callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Editio callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVE-2016-9693 [MEDIUM] CWE-20 CVE-2016-9693: IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine. I

CVE-2014-3076 [MEDIUM] CWE-200 CVE-2014-3076: IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially s IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.

CVE-2018-1384 [MEDIUM] CWE-79 CVE-2018-1384: IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows us IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135.

CVE-2017-1767 [MEDIUM] CWE-79 CVE-2017-1767: IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows us IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152.

CVE-2016-0227 [MEDIUM] CWE-79 CVE-2016-0227: Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2017-1494 [MEDIUM] CWE-79 CVE-2017-1494: IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows us IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692.

CVE-2017-1531 [MEDIUM] CWE-79 CVE-2017-1531: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerabi IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130410.

CVE-2017-1530 [MEDIUM] CWE-79 CVE-2017-1530: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerabi IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130409.

CVE-2017-1425 [MEDIUM] CWE-79 CVE-2017-1425: IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerabi IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478.

CVE-2017-1424 [MEDIUM] CWE-79 CVE-2017-1424: IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127477.

CVE-2017-1140 [MEDIUM] CWE-79 CVE-2017-1140: IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2017-1159 [MEDIUM] CWE-601 CVE-2017-1159: IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This co

CVE-2016-9731 [MEDIUM] CWE-79 CVE-2016-9731: IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2016-3056 [MEDIUM] CWE-79 CVE-2016-3056: Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 throu Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.

CVE-2016-5901 [MEDIUM] CWE-79 CVE-2016-5901: Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5 Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative fix 2016.09 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2015-0105 [MEDIUM] CWE-79 CVE-2015-0105: Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2015-1905 [MEDIUM] CWE-264 CVE-2015-1905: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5 The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.