CVSS: 5.3EPSS: 0%CPEs: 16EXPL: 0CVE-2018-1885
https://notcve.org/view.php?id=CVE-2018-1885
08 Apr 2019 — IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020. IBM Business Automation Workflow en sus versiones 18.0.0.0.0, 18.0.0.1 y 18.0.0.0.2 podría permitir a un atacante no autenticado obtener información sensible, utilizando una petición HTTP especialmente comprimida. IBM X-Force ID: 152020. • http://www.securityfocus.com/bid/107863 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 19EXPL: 0CVE-2018-1848
https://notcve.org/view.php?id=CVE-2018-1848
14 Dec 2018 — IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947. IBM Business Automation Workflow en sus versiones 18.0.0.0 y 18.0.0.1 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en l... • http://www.securityfocus.com/bid/106217 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2018-1674
https://notcve.org/view.php?id=CVE-2018-1674
20 Sep 2018 — IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109. IBM Business Process Manager, de la versión 8.5 a la 8.6 y de la versión 18.0.0.0 a la 18.0.0.1, es vulnerable a una in. Un atacante remoto podría enviar instrucciones SQL especialmente manipuladas que podrían permiti... • http://www.securitytracker.com/id/1041717 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.0EPSS: 0%CPEs: 80EXPL: 0CVE-2017-1756
https://notcve.org/view.php?id=CVE-2017-1756
30 Mar 2018 — IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856. La versión 8.6 de IBM Business Process Manager permite que las páginas web se almacenen localmente, lo que permite que sean leídas por otro usuario en el sistema. IBM X-Force ID: 135856. • http://www.ibm.com/support/docview.wss?uid=swg22010796 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 59EXPL: 0CVE-2017-1765
https://notcve.org/view.php?id=CVE-2017-1765
30 Mar 2018 — IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150. La versión 8.6 de IBM Business Process Manager podría permitir que un usuario autenticado con privilegios especiales revele información sensible sobre el servidor de la aplicación. IBM X-Force ID: 136150. • http://www.ibm.com/support/docview.wss?uid=swg22011844 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 100EXPL: 0CVE-2018-1384
https://notcve.org/view.php?id=CVE-2018-1384
30 Mar 2018 — IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135. IBM Business Process Manager 8.6 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades prev... • http://www.ibm.com/support/docview.wss?uid=swg22012604 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2015-7463
https://notcve.org/view.php?id=CVE-2015-7463
15 Mar 2018 — IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393. IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5 y 8.5.6.0 hasta el fix 2 acumulativo, permite que los usuarios autenticados remotos borren datos de tareas y procesos aprovechándose de las comprobaciones de autorización incorrectas. IBM X-Force ID: 108393. • http://www-01.ibm.com/support/docview.wss?uid=swg21973442 • CWE-285: Improper Authorization •
CVSS: 5.4EPSS: 0%CPEs: 72EXPL: 0CVE-2017-1531
https://notcve.org/view.php?id=CVE-2017-1531
26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130410. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario... • http://www.ibm.com/support/docview.wss?uid=swg22007354 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 72EXPL: 0CVE-2017-1539
https://notcve.org/view.php?id=CVE-2017-1539
26 Sep 2017 — IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a un escalado de privilegios debido a que no distinguen entre la pertenencia a un grupo interno o la pertenencia a un grupo de usuarios registrados. Med... • http://www.ibm.com/support/docview.wss?uid=swg22007451 •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2017-1425
https://notcve.org/view.php?id=CVE-2017-1425
26 Sep 2017 — IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478. IBM Business Process Manager en sus versiones 8.0.1.1 y 8.5.7 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario ... • http://www.ibm.com/support/docview.wss?uid=swg22006265 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •