CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-20306
https://notcve.org/view.php?id=CVE-2021-20306
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality. Se encontró un fallo en el editor BPMN en versión jBPM 7.51.0.Final. Cualquier usuario autenticado de cualquier proyecto puede visualizar el nombre de los Ruleflow Groups de otros proyectos, a pesar de que el usuario no tenga acceso a esos proyectos. • https://bugzilla.redhat.com/show_bug.cgi?id=1946213 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0CVE-2013-6465
https://notcve.org/view.php?id=CVE-2013-6465
Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs. Múltiples vulnerabilidades Cross-Site Scripting (XSS) en JBPM KIE Workbench 6.0.x permiten que los usuarios autenticados remotos inyecten scripts web o HTML arbitrarios a través de vectores relacionados con las entradas HTML de nombres de tareas. • https://bugzilla.redhat.com/show_bug.cgi?id=1048380 https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04 https://github.com/kiegroup/jbpm-wb/compare/6.0.x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-7545 – jbpmmigration: XXE vulnerability in XmlUtils
https://notcve.org/view.php?id=CVE-2017-7545
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks. Se ha descubierto que la clase XmlUtils en jbpmmigration 6.5 realizaba la expansión de entidades externas de parámetros mientras analizaba archivos XML. Un atacante remoto podría utilizar este fallo para leer archivos accesibles para el usuario que ejecuta el servidor de aplicaciones y, potencialmente, realizar otros ataques más avanzados de XXE (XML External Entity). It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. • http://www.securityfocus.com/bid/102179 https://access.redhat.com/errata/RHSA-2017:3354 https://access.redhat.com/errata/RHSA-2017:3355 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545 https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d https://access.redhat.com/security/cve/CVE-2017-7545 https://bugzilla.redhat.com/show_bug.cgi?id=1474822 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8125 – jBPM: BPMN2 file processing XXE in Process Execution
https://notcve.org/view.php?id=CVE-2014-8125
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file. Vulnerabilidad de entidad externa XML (XXE) en Drools and jBPM anterior a 6.2.0 permite a atacantes remotos leer ficheros arbitrarios o posiblemente tener otro impacto no especificado a través de un fichero BPMN2 manipulado. It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks. • http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html https://bugzilla.redhat.com/show_bug.cgi?id=1169553 https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3 https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5 https://access.redhat.com/security/cve/CVE-2014-8125 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2014-3682 – jbpm-designer: XXE in BPMN2 import
https://notcve.org/view.php?id=CVE-2014-3682
XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file. Vulnerabilidad de entidad externa XML (XXE) en la función JBPMBpmn2ResourceImpl en designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java en jbpm-designer 6.0.x y 6.2.x permite a atacantes remotos leer ficheros arbitrarios y posiblemenete tener otro impacto no especificado mediante la importación de un fichero BPMN2 manipulado. An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. • http://rhn.redhat.com/errata/RHSA-2015-0234.html http://rhn.redhat.com/errata/RHSA-2015-0235.html https://github.com/droolsjbpm/jbpm-designer/commit/5641588c730cc75dc3b76c34b76271fbd407fb84 https://github.com/droolsjbpm/jbpm-designer/commit/69d8f6b7a099594bd0536f88d528753875857088 https://github.com/droolsjbpm/jbpm-designer/commit/be3968d51299f6de0011324be60223ede49ecb1c https://github.com/droolsjbpm/jbpm-designer/commit/e4691214a100718c3b1c9b93d4db466672ba0be3 https://access.redhat.com/security/cve/CVE-2014-3682 https://bugzilla.redhat.com&#x • CWE-611: Improper Restriction of XML External Entity Reference •