CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4557
https://notcve.org/view.php?id=CVE-2020-4557
29 Jun 2020 — IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611. IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.5 y 8.6, son vulnerables a un ataque de tipo cross-... • https://exchange.xforce.ibmcloud.com/vulnerabilities/183611 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4532
https://notcve.org/view.php?id=CVE-2020-4532
17 Jun 2020 — IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182716. IBM Business Automation Workflow e IBM Business Process Manager (IBM Business Process Manager Express versiones 8.5.5, 8.5.6, 8.5.7 y 8.6), podrían permit... • https://exchange.xforce.ibmcloud.com/vulnerabilities/182716 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4490
https://notcve.org/view.php?id=CVE-2020-4490
29 May 2020 — IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989 IBM Business Automation Workflow versiones 18 y 19, e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, podrían permitir a un atacante remoto omitir restricciones de seguridad, causadas por un fallo de ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/181989 •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4446
https://notcve.org/view.php?id=CVE-2020-4446
06 May 2020 — IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126. IBM Business Process Manager versiones 8.0, 8.5 y 8.6 e IBM Business Automation Workflow versiones 18.0 y 19.0, podrían permitir a un atacante remoto omitir las restricciones de seguridad, causadas mediante el fallo al realizar comprobaciones de autorización ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/181126 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2019-4669
https://notcve.org/view.php?id=CVE-2019-4669
27 Feb 2020 — IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254. IBM Business Process Manager versiones 8.5.7.0 hasta 8.5.7.0 2017.06, versiones 8.6.0.0 hasta 8.6.0.0 CF2018.03, e IBM Business Autom... • https://exchange.xforce.ibmcloud.com/vulnerabilities/171254 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2019-4426
https://notcve.org/view.php?id=CVE-2019-4426
13 Dec 2019 — The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772. El componente Case Builder entregado con versiones 18.0.0.1 hasta 19.0.0.2 e IBM Case Manager versiones 5.1.1 hasta 5.3, es vulnerable a ataques de ti... • https://exchange.xforce.ibmcloud.com/vulnerabilities/162772 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2019-4149
https://notcve.org/view.php?id=CVE-2019-4149
05 Sep 2019 — IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415. IBM Business Automation Wor... • https://exchange.xforce.ibmcloud.com/vulnerabilities/158415 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 0%CPEs: 17EXPL: 0CVE-2019-4424
https://notcve.org/view.php?id=CVE-2019-4424
20 Aug 2019 — IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1 y 19.0.0.2 es vulnerable a un ataque de inyección de entidadexterna XML (XXE) al procesar datos XML. Un atacante remoto podría ap... • https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.7EPSS: 0%CPEs: 16EXPL: 0CVE-2019-4425
https://notcve.org/view.php?id=CVE-2019-4425
20 Aug 2019 — IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1 y 18.0.0.2 podría permitir a un usuario obtener información altamente confidencial de otro usuario insertando enlaces en los que los usuarios desprevenidos harían clic. ID de IBM X-Force: 162771. • https://exchange.xforce.ibmcloud.com/vulnerabilities/162771 •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-4410
https://notcve.org/view.php?id=CVE-2019-4410
01 Jul 2019 — IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657. IBM Business Automation Workflow versiones 18.0.0.0, 18.0.0.1, 18.0.0.2, y 19.0.0.1 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrusta... • http://www.securityfocus.com/bid/108993 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •