CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2014-4844
https://notcve.org/view.php?id=CVE-2014-4844
The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to bypass intended access restrictions via a project action for a (1) process application or (2) toolkit. La funcionalidad import/export en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.5 permite a usuarios remotos autenticados evadir las restricciones de acceso a través de una acción de proyecto para (1) una aplicación de proyecto o (2) una caja de herramientas. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR51286 http://www.ibm.com/support/docview.wss?uid=swg21690554 https://exchange.xforce.ibmcloud.com/vulnerabilities/95724 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2014-6176
https://notcve.org/view.php?id=CVE-2014-6176
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher. IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, y Business Process Manager Advanced 7.5.x hasta 7.5.1.2, 8.0.x hasta 8.0.1.3, y 8.5.x hasta 8.5.5 desatienden la configuración SSL setting en el enlace de importación de HTTP del módulo SCA y seleccionan incondicionalmente el protocolo SSLv3, lo que facilita a atacantes remotos secuestrar sesiones o obtener información sensible a través del aprovechamiento del uso de un cifrado débil. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR51593 http://www-01.ibm.com/support/docview.wss?uid=swg21690780 http://www.securitytracker.com/id/1031382 http://www.securitytracker.com/id/1031383 https://exchange.xforce.ibmcloud.com/vulnerabilities/98488 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2014-6101
https://notcve.org/view.php?id=CVE-2014-6101
Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en la caracteristica redirect-login en IBM Business Process Manager (BPM) Advanced 7.5 hasta 8.5.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://secunia.com/advisories/61804 http://www-01.ibm.com/support/docview.wss?uid=swg1JR51211 http://www-01.ibm.com/support/docview.wss?uid=swg1JR51507 http://www-01.ibm.com/support/docview.wss?uid=swg21687967 https://exchange.xforce.ibmcloud.com/vulnerabilities/96024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 18EXPL: 0CVE-2014-4758
https://notcve.org/view.php?id=CVE-2014-4758
IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL. IBM Business Process Manager (BPM) 7.5.x hasta 8.5.5 y WebSphere Lombardi Edition 7.2.x permiten a usuarios remotos autenticados evadir las restricciones de acceso y enviar solicitudes a los servicios internos a través de una URL callService. • http://secunia.com/advisories/60851 http://www-01.ibm.com/support/docview.wss?uid=swg1JR50215 http://www-01.ibm.com/support/docview.wss?uid=swg21680795 https://exchange.xforce.ibmcloud.com/vulnerabilities/94485 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3075
https://notcve.org/view.php?id=CVE-2014-3075
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 8.5.5 y WebSphere Lombardi Edition 7.2.0.x permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero subido. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50092 http://www-01.ibm.com/support/docview.wss?uid=swg21679979 https://exchange.xforce.ibmcloud.com/vulnerabilities/93817 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •