Page 11 of 75 results (0.017 seconds)

CVSS: 3.5EPSS: 0%CPEs: 55EXPL: 0

Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en la REST API en IBM Business Process Manager (BPM) en sus versiones 7.5.x hasta la 7.5.1.2, 8.0.x hasta la 8.0.1.3, 8.5.0 hasta la 8.5.0.1, 8.5.5 hasta la 8.5.5.0 y 8.5.6 hasta la 8.5.6.0 permite a usuarios remotos autenticados realizar una inyección arbitraria de web script o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772 http://www-01.ibm.com/support/docview.wss?uid=swg21700717 http://www.securitytracker.com/id/1033002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.0EPSS: 0%CPEs: 51EXPL: 0

The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors. Vulnerabilidad en la REST API en IBM Business Process Manager (BPM) en sus versiones 7.5.x hasta la 7.5.1.2, 8.0.x hasta la 8.0.1.3, 8.5.0 hasta la 8.5.0.1, 8.5.5 hasta la 8.5.5.0 y 8.5.6 hasta la 8.5.6.0 permite a usuarios remotos autenticados evadir la restricción de intento de acceso sobre el cambio de valor task-variable a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772 http://www-01.ibm.com/support/docview.wss?uid=swg21700717 http://www.securityfocus.com/bid/75977 http://www.securitytracker.com/id/1033002 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.0EPSS: 0%CPEs: 39EXPL: 0

The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call. La REST API en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, 8.5.5 hasta 8.5.5.0 y 8.5.6 hasta 8.5.6.0, permite a usuarios remotos autenticados saltarse las restricciones de acceso y ejecutar código JavaScript arbitrario en el servidor a través de una llamada a la API no especificada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR53356 http://www-01.ibm.com/support/docview.wss?uid=swg21959052 http://www.securityfocus.com/bid/75536 http://www.securitytracker.com/id/1032972 • CWE-284: Improper Access Control •

CVSS: 4.0EPSS: 0%CPEs: 57EXPL: 0

Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL. Vulnerabilidad de salto de directorio en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, y 8.5.5 hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2 hasta 7.2.0.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de una URL de ficheros de internacionalización manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957 http://www-01.ibm.com/support/docview.wss?uid=swg21700831 http://www.securityfocus.com/bid/75360 http://www.securitytracker.com/id/1032700 http://www.securitytracker.com/id/1032701 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 3.5EPSS: 0%CPEs: 57EXPL: 0

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada que provoca una condición de error. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR52626 http://www-01.ibm.com/support/docview.wss?uid=swg21697944 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •