Ibm

Business Process Manager

88 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4

CVE-2014-4759

  • EPSS 0.18%
  • Published 04.09.2014 10:55:07
  • Last modified 12.04.2025 10:46:40

An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading docu...

4

CVE-2014-4758

  • EPSS 0.2%
  • Published 04.09.2014 10:55:07
  • Last modified 12.04.2025 10:46:40

IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.

3.5

CVE-2014-3075

  • EPSS 0.19%
  • Published 04.09.2014 10:55:06
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.

4

CVE-2014-3087

  • EPSS 0.29%
  • Published 17.08.2014 23:55:06
  • Last modified 12.04.2025 10:46:40

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity r...

5

CVE-2014-3076

  • EPSS 0.45%
  • Published 11.08.2014 22:55:04
  • Last modified 12.04.2025 10:46:40

IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.

4.3

CVE-2014-0957

  • EPSS 0.28%
  • Published 18.07.2014 00:55:04
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.

6

CVE-2014-0908

  • EPSS 0.5%
  • Published 10.04.2014 23:55:04
  • Last modified 12.04.2025 10:46:40

The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authentica...

3.5

CVE-2013-0581

  • EPSS 0.19%
  • Published 06.07.2013 13:57:33
  • Last modified 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socia...