Redhat

Jboss Bpm Suite

18 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2016-5401

  • EPSS 0.13%
  • Published 20.04.2017 21:59:00
  • Last modified 20.04.2025 01:37:25

Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.

5.4

CVE-2016-5398

  • EPSS 0.19%
  • Published 03.10.2016 18:59:06
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes.

8.8

CVE-2016-7034

  • EPSS 0.09%
  • Published 07.09.2016 18:59:07
  • Last modified 12.04.2025 10:46:40

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF protection mechanisms or (2) condu...

6.1

CVE-2016-7033

  • EPSS 0.22%
  • Published 07.09.2016 18:59:06
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

5.3

CVE-2016-6344

  • EPSS 0.32%
  • Published 07.09.2016 18:59:00
  • Last modified 12.04.2025 10:46:40

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.

9.8

CVE-2016-4999

  • EPSS 6.97%
  • Published 05.08.2016 15:59:06
  • Last modified 12.04.2025 10:46:40

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set looku...

7.5

CVE-2015-1818

  • EPSS 0.54%
  • Published 11.08.2015 14:59:00
  • Last modified 12.04.2025 10:46:40

XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side...

6.5

CVE-2013-6468

  • EPSS 0.47%
  • Published 10.04.2014 20:29:20
  • Last modified 12.04.2025 10:46:40

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.