Business Process Manager (Ibm) - vulnerabilities (CVEs)

88 CVEs, 0 in the last 30 days, 180 known versions, newest CVE from 2022-12-07. Vendor: Ibm.

CVEs of Business Process Manager

CVE-2022-41735 - CVSS 6.1 (medium), 2022-12-07: IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This…
CVE-2022-22361 - CVSS 6.5 (medium), 2022-05-31: IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM…
CVE-2021-39046 - CVSS 4.9 (medium), 2022-03-18: IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can…
CVE-2021-38893 - CVSS 6.4 (medium), 2021-12-21: IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This…
CVE-2021-38900 - CVSS 6.5 (medium), 2021-12-21: IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly…
CVE-2021-38883 - CVSS 5.4 (medium), 2021-12-17: IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This…
CVE-2021-29753 - CVSS 5.9 (medium), 2021-11-05: IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an…
CVE-2021-29834 - CVSS 6.4 (medium), 2021-09-29: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager…
CVE-2021-29751 - CVSS 4.3 (medium), 2021-06-28: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive…
CVE-2020-4794 - CVSS 5.4 (medium), 2020-12-21: IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could…
CVE-2020-4531 - CVSS 5.3 (medium), 2020-09-25: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive…
CVE-2020-4530 - CVSS 5.4 (medium), 2020-09-15: IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows…
CVE-2020-4698 - CVSS 6.4 (medium), 2020-09-08: IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This…
CVE-2020-4516 - CVSS 5.4 (medium), 2020-09-08: IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability…
CVE-2020-4557 - CVSS 5.4 (medium), 2020-06-29: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability…
CVE-2020-4532 - CVSS 5.3 (medium), 2020-06-17: IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote…
CVE-2020-4490 - CVSS 6.1 (medium), 2020-05-29: IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions,…
CVE-2020-4446 - CVSS 4.3 (medium), 2020-05-06: IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security…
CVE-2019-4669 - CVSS 6.3 (medium), 2020-02-27: IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through…
CVE-2019-4149 - CVSS 5.4 (medium), 2019-09-05: IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0…
CVE-2019-4424 - CVSS 8.2 (high), 2019-08-20: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when…
CVE-2019-4425 - CVSS 5.7 (medium), 2019-08-20: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting…
CVE-2019-4410 - CVSS 5.4 (medium), 2019-07-01: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
CVE-2019-4204 - CVSS 5.4 (medium), 2019-05-10: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
CVE-2019-4045 - CVSS 4.3 (medium), 2019-04-08: IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a…
CVE-2018-2000 - CVSS 8.8 (high), 2019-04-08: IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2018-1999 - CVSS 4.3 (medium), 2019-04-08: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid…
CVE-2018-1997 - CVSS 6.5 (medium), 2019-04-08: IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated…
CVE-2018-1885 - CVSS 5.3 (medium), 2019-04-08: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially…
CVE-2018-1848 - CVSS 6.1 (medium), 2018-12-14: IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2018-1674 - CVSS 8.8 (high), 2018-09-20: IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL…
CVE-2017-1766 - CVSS 4.3 (medium), 2018-03-30: Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151.
CVE-2017-1765 - CVSS 4.3 (medium), 2018-03-30: IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM…
CVE-2018-1384 - CVSS 5.4 (medium), 2018-03-30: IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2017-1756 - CVSS 4 (medium), 2018-03-30: IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856.
CVE-2017-1767 - CVSS 5.4 (medium), 2018-03-30: IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2015-7463 - CVSS 4.3 (medium), 2018-03-15: IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data…
CVE-2017-1769 - CVSS 8.8 (high), 2018-01-24: IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
CVE-2017-1494 - CVSS 5.4 (medium), 2017-12-20: IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2017-1628 - CVSS 6.5 (medium), 2017-11-27: IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks.
CVE-2017-1527 - CVSS 8.1 (high), 2017-09-26: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could…
CVE-2017-1539 - CVSS 8.8 (high), 2017-09-26: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user…
CVE-2017-1425 - CVSS 5.4 (medium), 2017-09-26: IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2017-1531 - CVSS 5.4 (medium), 2017-09-26: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2017-1530 - CVSS 5.4 (medium), 2017-09-26: IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2017-1346 - CVSS 2.5 (low), 2017-09-25: IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user…
CVE-2017-1424 - CVSS 5.4 (medium), 2017-09-25: IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2015-0110 - CVSS 6.5 (medium), 2017-09-15: IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass…
CVE-2015-0101 - CVSS 6.1 (medium), 2017-08-28: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business…
CVE-2017-1140 - CVSS 5.4 (medium), 2017-06-08: IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web…
CVE-2017-1159 - CVSS 5.4 (medium), 2017-05-22: IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to…
CVE-2016-9693 - CVSS 6.1 (medium), 2017-03-07: IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an…
CVE-2016-9731 - CVSS 5.4 (medium), 2017-02-01: IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2016-3056 - CVSS 5.4 (medium), 2016-10-14: Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0…
CVE-2016-5901 - CVSS 5.4 (medium), 2016-10-05: Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative fix 2016.09 allows…
CVE-2016-0349 - CVSS 6.5 (medium), 2016-06-30: IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions…
CVE-2015-7454 - CVSS 4.3 (medium), 2016-03-21: Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3,…
CVE-2016-0227 - CVSS 5.4 (medium), 2016-03-03: Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through…
CVE-2015-8524 - CVSS 6.1 (medium), 2016-02-29: Cross-site scripting (XSS) vulnerability in Process Portal in IBM Business Process Manager 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x…
CVE-2015-7441 - CVSS 6.8 (medium), 2016-01-01: Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through…
CVE-2015-4955 - CVSS 3.5 (low), 2015-10-03: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6…
CVE-2015-1904 - CVSS 3.5 (low), 2015-08-01: IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise…
CVE-2015-1906 - CVSS 3.5 (low), 2015-07-21: Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through…
CVE-2015-1905 - CVSS 4 (medium), 2015-07-21: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6…
CVE-2015-1961 - CVSS 9 (critical), 2015-07-13: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6…
CVE-2015-1884 - CVSS 4 (medium), 2015-06-28: Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through…
CVE-2015-0193 - CVSS 3.5 (low), 2015-05-30: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and…
CVE-2015-0156 - CVSS 3.5 (low), 2015-05-25: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and…
CVE-2015-0158 - CVSS 4.3 (medium), 2015-03-24: Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5…
CVE-2015-0106 - CVSS 4.3 (medium), 2015-03-24: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5…
CVE-2015-0105 - CVSS 4.3 (medium), 2015-03-24: Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5…
CVE-2015-0103 - CVSS 3.5 (low), 2015-03-24: Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1,…
CVE-2014-6139 - CVSS 4 (medium), 2015-02-13: The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and…
CVE-2014-8914 - CVSS 3.5 (low), 2015-01-21: Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows…
CVE-2014-8913 - CVSS 3.5 (low), 2015-01-21: Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows…
CVE-2014-6173 - CVSS 3.5 (low), 2014-12-19: Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows…
CVE-2014-6182 - CVSS 4 (medium), 2014-12-17: Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through…
CVE-2014-4844 - CVSS 6.5 (medium), 2014-12-17: The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote…
CVE-2014-6176 - CVSS 4.3 (medium), 2014-12-16: IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3,…
CVE-2014-6101 - CVSS 4.3 (medium), 2014-10-31: Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote…
CVE-2014-4802 - CVSS 4 (medium), 2014-10-07: The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and…
CVE-2014-4759 - CVSS 4 (medium), 2014-09-04: An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to…
CVE-2014-4758 - CVSS 4 (medium), 2014-09-04: IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access…
CVE-2014-3075 - CVSS 3.5 (low), 2014-09-04: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote…
CVE-2014-3087 - CVSS 4 (medium), 2014-08-17: callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to…
CVE-2014-3076 - CVSS 5 (medium), 2014-08-11: IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP…
CVE-2014-0957 - CVSS 4.3 (medium), 2014-07-18: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to…
CVE-2014-0908 - CVSS 6 (medium), 2014-04-10: The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not…
CVE-2013-0581 - CVSS 3.5 (low), 2013-07-06: Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated…