Ibm

Business Process Manager

88 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4

CVE-2014-4759

  • EPSS 0.18%
  • Veröffentlicht 04.09.2014 10:55:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading docu...

4

CVE-2014-4758

  • EPSS 0.2%
  • Veröffentlicht 04.09.2014 10:55:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.

3.5

CVE-2014-3075

  • EPSS 0.19%
  • Veröffentlicht 04.09.2014 10:55:06
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.

4

CVE-2014-3087

  • EPSS 0.29%
  • Veröffentlicht 17.08.2014 23:55:06
  • Zuletzt bearbeitet 12.04.2025 10:46:40

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity r...

5

CVE-2014-3076

  • EPSS 0.45%
  • Veröffentlicht 11.08.2014 22:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.

4.3

CVE-2014-0957

  • EPSS 0.28%
  • Veröffentlicht 18.07.2014 00:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.

6

CVE-2014-0908

  • EPSS 0.5%
  • Veröffentlicht 10.04.2014 23:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authentica...

3.5

CVE-2013-0581

  • EPSS 0.19%
  • Veröffentlicht 06.07.2013 13:57:33
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socia...