CVSS: 3.5EPSS: 0%CPEs: 61EXPL: 0CVE-2015-0156
https://notcve.org/view.php?id=CVE-2015-0156
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.6.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812 http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420 http://www-01.ibm.com/support/docview.wss?uid=swg21697120 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 46EXPL: 0CVE-2015-0106
https://notcve.org/view.php?id=CVE-2015-0106
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0 hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, y 8.5.5 hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50795 http://www-01.ibm.com/support/docview.wss?uid=swg21694935 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 18EXPL: 0CVE-2014-4758
https://notcve.org/view.php?id=CVE-2014-4758
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL. IBM Business Process Manager (BPM) 7.5.x hasta 8.5.5 y WebSphere Lombardi Edition 7.2.x permiten a usuarios remotos autenticados evadir las restricciones de acceso y enviar solicitudes a los servicios internos a través de una URL callService. • http://secunia.com/advisories/60851 http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215 http://www-01.ibm.com/support/docview.wss?uid=swg21680795 https://exchange.xforce.ibmcloud.com/vulnerabilities/94485 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3075
https://notcve.org/view.php?id=CVE-2014-3075
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 8.5.5 y WebSphere Lombardi Edition 7.2.0.x permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero subido. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50092 http://www-01.ibm.com/support/docview.wss?uid=swg21679979 https://exchange.xforce.ibmcloud.com/vulnerabilities/93817 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 13EXPL: 0CVE-2014-3087
https://notcve.org/view.php?id=CVE-2014-3087
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. callService.do en IBM Business Process Manager (BPM) 7.5 hasta 8.5.5 y WebSphere Lombardi Edition 7.2 hasta 7.2.0.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de una declaración de entidad externa XML en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE). • http://secunia.com/advisories/60752 http://secunia.com/advisories/60755 http://secunia.com/advisories/60757 http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616 http://www-01.ibm.com/support/docview.wss?uid=swg21679726 http://www.securityfocus.com/bid/69264 https://exchange.xforce.ibmcloud.com/vulnerabilities/94112 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •