CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2014-3087
https://notcve.org/view.php?id=CVE-2014-3087
17 Aug 2014 — callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. callService.do en IBM Business Process Manager (BPM) 7.5 hasta 8.5.5 y WebSphere Lombardi Edition 7.2 hasta 7.2.0.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de una declara... • http://secunia.com/advisories/60752 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 0CVE-2014-0957
https://notcve.org/view.php?id=CVE-2014-0957
18 Jul 2014 — Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a service failure. Vulnerabilidad de XSS en IBM Business Process Manager 7.5 hasta 8.5.5, y WebSphere Lombardi Edition 7.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada que provoca un fallo de servicio. • http://secunia.com/advisories/59557 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2014-0908
https://notcve.org/view.php?id=CVE-2014-0908
10 Apr 2014 — The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for read or write access to attribute values, which allows remote authenticated users to obtain sensitive information, configure e-mail notifications, or modify task assignments via REST API calls. La implementación User Attribute en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.2 y 8.5.x hasta 8.5.0.1 no ver... • http://www-01.ibm.com/support/docview.wss?uid=swg1JR49505 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2013-0581
https://notcve.org/view.php?id=CVE-2013-0581
06 Jul 2013 — Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socialPortal/dashboard.jsp, (2) teamworks/executeServiceByName, (3) portal/jsp/viewAdHocReportWizard.do, or (4) rest/bpm/wle/v1/process. Multiples Vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en IBM Business Process Manager (BPM) v7.5.1.x, v8.0... • http://www-01.ibm.com/support/docview.wss?uid=swg1JR45799 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •