Page 2 of 54 results (0.003 seconds)

CVSS: 4.0EPSS: 0%CPEs: 80EXPL: 0

CVE-2017-1756

https://notcve.org/view.php?id=CVE-2017-1756

30 Mar 2018 — IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856. La versión 8.6 de IBM Business Process Manager permite que las páginas web se almacenen localmente, lo que permite que sean leídas por otro usuario en el sistema. IBM X-Force ID: 135856. • http://www.ibm.com/support/docview.wss?uid=swg22010796 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 59EXPL: 0

CVE-2017-1765

https://notcve.org/view.php?id=CVE-2017-1765

30 Mar 2018 — IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150. La versión 8.6 de IBM Business Process Manager podría permitir que un usuario autenticado con privilegios especiales revele información sensible sobre el servidor de la aplicación. IBM X-Force ID: 136150. • http://www.ibm.com/support/docview.wss?uid=swg22011844 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.4EPSS: 0%CPEs: 100EXPL: 0

CVE-2018-1384

https://notcve.org/view.php?id=CVE-2018-1384

30 Mar 2018 — IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135. IBM Business Process Manager 8.6 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades prev... • http://www.ibm.com/support/docview.wss?uid=swg22012604 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0

CVE-2015-7463

https://notcve.org/view.php?id=CVE-2015-7463

15 Mar 2018 — IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393. IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5 y 8.5.6.0 hasta el fix 2 acumulativo, permite que los usuarios autenticados remotos borren datos de tareas y procesos aprovechándose de las comprobaciones de autorización incorrectas. IBM X-Force ID: 108393. • http://www-01.ibm.com/support/docview.wss?uid=swg21973442 • CWE-285: Improper Authorization •

CVSS: 8.1EPSS: 0%CPEs: 72EXPL: 0

CVE-2017-1527

https://notcve.org/view.php?id=CVE-2017-1527

26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a ataques de tipo XML External Entity Injection (XXE) al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información sensibl... • http://www.ibm.com/support/docview.wss?uid=swg22007346 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 5.4EPSS: 0%CPEs: 72EXPL: 0

CVE-2017-1530

https://notcve.org/view.php?id=CVE-2017-1530

26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130409. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario... • http://www.ibm.com/support/docview.wss?uid=swg22007351 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 72EXPL: 0

CVE-2017-1531

https://notcve.org/view.php?id=CVE-2017-1531

26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130410. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario... • http://www.ibm.com/support/docview.wss?uid=swg22007354 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 72EXPL: 0

CVE-2017-1539

https://notcve.org/view.php?id=CVE-2017-1539

26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a un escalado de privilegios debido a que no distinguen entre la pertenencia a un grupo interno o la pertenencia a un grupo de usuarios registrados. Med... • http://www.ibm.com/support/docview.wss?uid=swg22007451 •

CVSS: 2.5EPSS: 0%CPEs: 72EXPL: 0

CVE-2017-1346

https://notcve.org/view.php?id=CVE-2017-1346

25 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461. IBM Business Process Manager 7.5, 8.0 y 8.5 guarda temporalmente los archivos en una carpeta temporal durante las instalaciones offline, los cuales podrían ser leídos por un usuario local en un corto espacio de tiempo. IBM X-Force ID: 126461. • http://www.ibm.com/support/docview.wss?uid=swg22004654 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0

CVE-2015-0110

https://notcve.org/view.php?id=CVE-2015-0110

15 Sep 2017 — IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL. IBM Business Process Manager (BPM) 7.5.x, 8.0.x y 8.5.x y WebSphere Lombardi Edition (WLE) 7.2.x permiten que usuarios autenticados remotos omitan las restricciones de acceso establecidas en tipos de servicios internos mediante vectores relacionados co... • http://www.securityfocus.com/bid/73274 • CWE-284: Improper Access Control •