CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-7545 – jbpmmigration: XXE vulnerability in XmlUtils
https://notcve.org/view.php?id=CVE-2017-7545
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks. Se ha descubierto que la clase XmlUtils en jbpmmigration 6.5 realizaba la expansión de entidades externas de parámetros mientras analizaba archivos XML. Un atacante remoto podría utilizar este fallo para leer archivos accesibles para el usuario que ejecuta el servidor de aplicaciones y, potencialmente, realizar otros ataques más avanzados de XXE (XML External Entity). It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. • http://www.securityfocus.com/bid/102179 https://access.redhat.com/errata/RHSA-2017:3354 https://access.redhat.com/errata/RHSA-2017:3355 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545 https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d https://access.redhat.com/security/cve/CVE-2017-7545 https://bugzilla.redhat.com/show_bug.cgi?id=1474822 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7463 – business-central: Reflected XSS in artifact upload error message
https://notcve.org/view.php?id=CVE-2017-7463
JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user. JBoss BRMS 6 y BPM Suite 6 en versiones anteriores a la 6.4.3 son vulnerables a un Cross-Site Scripting (XSS) reflejado a través de la carga de artefactos. Un archivo XML mal formado, si se carga, provoca que aparezca un mensaje de error que incluye parte del código XML incorrecto verbatim sin filtrar los scripts. • http://www.securityfocus.com/bid/98385 https://access.redhat.com/errata/RHSA-2017:1217 https://access.redhat.com/errata/RHSA-2017:1218 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463 https://access.redhat.com/security/cve/CVE-2017-7463 https://bugzilla.redhat.com/show_bug.cgi?id=1439823 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 2%CPEs: 1EXPL: 0CVE-2017-2674 – business-central: Multiple stored XSS in task and process filters
https://notcve.org/view.php?id=CVE-2017-2674
JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins. JBoss BRMS 6 y BPM Suite 6 en versiones anteriores a la 6.4.3 son vulnerables a un Cross-Site Scripting (XSS) persistente a través de varias listas en Business Central. La vulnerabilidad se debe a la falta de saneamiento de las entradas de los usuarios al crear nuevas listas. • http://www.securityfocus.com/bid/98390 https://access.redhat.com/errata/RHSA-2017:1217 https://access.redhat.com/errata/RHSA-2017:1218 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 https://access.redhat.com/security/cve/CVE-2017-2674 https://bugzilla.redhat.com/show_bug.cgi?id=1439819 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5401
https://notcve.org/view.php?id=CVE-2016-5401
Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page. Vulnerabilidad CSRF en Red Hat JBoss BRMS y BPMS 6 permite atacantes remotos secuestrar la autenticación de los usuarios para las solicitudes que modifican instancias a través de una página web manipulada. • https://bugzilla.redhat.com/show_bug.cgi?id=1357731 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6343 – Dashbuilder: Reflected XSS
https://notcve.org/view.php?id=CVE-2016-6343
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of script code within the context of the affected user. JBoss BPM Suite 6 es vulnerable a Cross-Site Scripting (XSS) reflejado mediante dashbuilder. Los atacantes remotos pueden engañar a los usuarios autenticados con privilegios de acceso a dashbuilder (normalmente, los administradores) para que hagan clic en enlaces a /dashbuilder/Controller que contienen scripts maliciosos. su explotación con éxito podría permitir la ejecución de código script en el contexto del usuario afectado. • http://rhn.redhat.com/errata/RHSA-2017-0557.html http://www.securityfocus.com/bid/96987 https://access.redhat.com/errata/RHSA-2018:0296 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6343 https://access.redhat.com/security/cve/CVE-2016-6343 https://bugzilla.redhat.com/show_bug.cgi?id=1371801 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •