CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29775
https://notcve.org/view.php?id=CVE-2021-29775
IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029. IBM Business Automation Workflow versiones 19.0.03 y 20.0 e IBM Cloud Pak for Automation versiones 20.0.3-IF002 y 21.0.1, son vulnerables a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista y conllevando potencialmente a una divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/203029 https://www.ibm.com/support/pages/node/6465127 https://www.ibm.com/support/pages/node/6467057 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-29751
https://notcve.org/view.php?id=CVE-2021-29751
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779. IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.5 y 8.6, podrían permitir a un usuario autenticado obtener información confidencial sobre otro usuario bajo configuraciones no predeterminadas. IBM X-Force ID: 201779 • https://exchange.xforce.ibmcloud.com/vulnerabilities/201779 https://www.ibm.com/support/pages/node/6465127 https://www.ibm.com/support/pages/node/6467055 •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-4768
https://notcve.org/view.php?id=CVE-2020-4768
IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188907. IBM Case Manager versiones 5.2 y 5.3 e IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0, son vulnerables a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a los usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista que puede conllevar a una divulgación de credenciales dentro de una sesión de confianza. • https://exchange.xforce.ibmcloud.com/vulnerabilities/188907 https://www.ibm.com/support/pages/node/6414377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 51EXPL: 0CVE-2020-4794
https://notcve.org/view.php?id=CVE-2020-4794
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445. IBM Automation Workstream Services versiones 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versión 8.6, podrían permitir a un usuario autenticado conseguir información confidencial o causar una denegación de servicio debido a una comprobación inapropiada de autorización. IBM X-Force ID: 189445 • https://exchange.xforce.ibmcloud.com/vulnerabilities/189445 https://www.ibm.com/support/pages/node/6359463 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-4531
https://notcve.org/view.php?id=CVE-2020-4531
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715. IBM Business Automation Workflow versiones 18.0, 19.0 y 20.0 e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, podrían permitir a un atacante remoto obtener información confidencial cuando es devuelto un mensaje de error técnico detallado en el navegador. Esta información podría ser usada en nuevos ataques contra el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/182715 https://www.ibm.com/support/pages/node/6336935 • CWE-252: Unchecked Return Value •