CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-4759
https://notcve.org/view.php?id=CVE-2014-4759
An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive information by performing a document-attachment search and then reading document properties in the search results. Un servicio Ajax no especificado en el juego de herramientas Content Management en IBM Business Process Manager (BPM) 8.5.x hasta 8.5.5 permite a usuarios remotos autenticados obtener información sensible mediante la realización de una búsqueda de adjuntos de documentos y posteriormente la lectura de las propiedades de documentos en los resultados de la búsqueda. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50871 http://www-01.ibm.com/support/docview.wss?uid=swg21680809 https://exchange.xforce.ibmcloud.com/vulnerabilities/94486 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 13EXPL: 0CVE-2014-3087
https://notcve.org/view.php?id=CVE-2014-3087
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. callService.do en IBM Business Process Manager (BPM) 7.5 hasta 8.5.5 y WebSphere Lombardi Edition 7.2 hasta 7.2.0.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de una declaración de entidad externa XML en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE). • http://secunia.com/advisories/60752 http://secunia.com/advisories/60755 http://secunia.com/advisories/60757 http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616 http://www-01.ibm.com/support/docview.wss?uid=swg21679726 http://www.securityfocus.com/bid/69264 https://exchange.xforce.ibmcloud.com/vulnerabilities/94112 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-3076
https://notcve.org/view.php?id=CVE-2014-3076
IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page. IBM Business Process Manager (BPM) 8.5 hasta 8.5.5 permite a atacantes remotos obtener información potencialmente sensible mediante la visita a una página no especificada de diagnóstica JSP. • http://secunia.com/advisories/60614 http://www-01.ibm.com/support/docview.wss?uid=swg1JR50760 http://www-01.ibm.com/support/docview.wss?uid=swg21679976 http://www.securitytracker.com/id/1030666 https://exchange.xforce.ibmcloud.com/vulnerabilities/93822 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2014-0957
https://notcve.org/view.php?id=CVE-2014-0957
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure. Vulnerabilidad de XSS en IBM Business Process Manager 7.5 hasta 8.5.5, y WebSphere Lombardi Edition 7.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada que provoca un fallo de servicio. • http://secunia.com/advisories/59557 http://www-01.ibm.com/support/docview.wss?uid=swg1JR49990 http://www-01.ibm.com/support/docview.wss?uid=swg21679064 https://exchange.xforce.ibmcloud.com/vulnerabilities/92738 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •