CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4490
https://notcve.org/view.php?id=CVE-2020-4490
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989 IBM Business Automation Workflow versiones 18 y 19, e IBM Business Process Manager versiones 8.0, 8.5 y 8.6, podrían permitir a un atacante remoto omitir restricciones de seguridad, causadas por un fallo de tabnabbing inverso. Un atacante podría explotar esta vulnerabilidad y redirigir una victima hacia un sitio de phishing. IBM X-Force ID: 181989 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181989 https://www.ibm.com/support/pages/node/6217550 •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4446
https://notcve.org/view.php?id=CVE-2020-4446
IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126. IBM Business Process Manager versiones 8.0, 8.5 y 8.6 e IBM Business Automation Workflow versiones 18.0 y 19.0, podrían permitir a un atacante remoto omitir las restricciones de seguridad, causadas mediante el fallo al realizar comprobaciones de autorización insuficientes. ID de IBM X-Force: 181126. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181126 https://www.ibm.com/support/pages/node/6205805 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2019-4149
https://notcve.org/view.php?id=CVE-2019-4149
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415. IBM Business Automation Workflow versión 18.0.0.0 hasta la versión 18.0.0.2 e IBM Business Process Manager versión 8.6.0.0 hasta la versión 8.6.0.0 Cumulative Fix 2018.03, versión 8.5.7.0 hasta la versión 8.5.7.0 Cumulative Fix 2017.06, y versión 8.5.6.0 hasta la versión 8.5.6.0 CF2 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conducir a la divulgación de credenciales dentro de una sesión de confianza. • https://exchange.xforce.ibmcloud.com/vulnerabilities/158415 https://www.ibm.com/support/docview.wss?uid=ibm10885104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 0%CPEs: 17EXPL: 0CVE-2019-4424
https://notcve.org/view.php?id=CVE-2019-4424
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1 y 19.0.0.2 es vulnerable a un ataque de inyección de entidadexterna XML (XXE) al procesar datos XML. Un atacante remoto podría aprovechar esta vulnerabilidad para exponer información confidencial o consumir recursos de memoria. • https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 https://www.ibm.com/support/docview.wss?uid=ibm10959537 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.7EPSS: 0%CPEs: 16EXPL: 0CVE-2019-4425
https://notcve.org/view.php?id=CVE-2019-4425
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1 y 18.0.0.2 podría permitir a un usuario obtener información altamente confidencial de otro usuario insertando enlaces en los que los usuarios desprevenidos harían clic. ID de IBM X-Force: 162771. • https://exchange.xforce.ibmcloud.com/vulnerabilities/162771 https://www.ibm.com/support/docview.wss?uid=ibm10959261 •