Show filters
51 Total Results
Displaying 41-50 of 51
Sort by:
Attacker Value
Unknown
CVE-2014-4844
Disclosure Date: December 17, 2014 (last updated October 05, 2023)
The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to bypass intended access restrictions via a project action for a (1) process application or (2) toolkit.
0
Attacker Value
Unknown
CVE-2014-6176
Disclosure Date: December 16, 2014 (last updated October 05, 2023)
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
0
Attacker Value
Unknown
CVE-2014-6101
Disclosure Date: October 31, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
0
Attacker Value
Unknown
CVE-2014-4802
Disclosure Date: October 07, 2014 (last updated October 05, 2023)
The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.
0
Attacker Value
Unknown
CVE-2014-4759
Disclosure Date: September 04, 2014 (last updated October 05, 2023)
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results.
0
Attacker Value
Unknown
CVE-2014-3075
Disclosure Date: September 04, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.
0
Attacker Value
Unknown
CVE-2014-4758
Disclosure Date: September 04, 2014 (last updated October 05, 2023)
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.
0
Attacker Value
Unknown
CVE-2014-3087
Disclosure Date: August 17, 2014 (last updated October 05, 2023)
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
0
Attacker Value
Unknown
CVE-2014-3076
Disclosure Date: August 11, 2014 (last updated October 05, 2023)
IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.
0
Attacker Value
Unknown
CVE-2014-0957
Disclosure Date: July 18, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure.
0
