Page 6 of 48 results (0.005 seconds)

CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0

CVE-2018-1674

https://notcve.org/view.php?id=CVE-2018-1674

IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109. IBM Business Process Manager, de la versión 8.5 a la 8.6 y de la versión 18.0.0.0 a la 18.0.0.1, es vulnerable a una in. Un atacante remoto podría enviar instrucciones SQL especialmente manipuladas que podrían permitir que el atacante viese, añadiese, modificase o borrase información en la base de datos del backend. • http://www.securitytracker.com/id/1041717 https://exchange.xforce.ibmcloud.com/vulnerabilities/145109 https://www.ibm.com/support/docview.wss?uid=ibm10720035 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0

CVE-2017-1766

https://notcve.org/view.php?id=CVE-2017-1766

Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151. Debido a una autorización incorrecta en la versión 8.6 de IBM Business Process Manager, un atacante puede reclamar y trabajar en tareas ad hoc a las que no está asignado. IBM X-Force ID: 136151. • http://www.ibm.com/support/docview.wss?uid=swg22011866 https://exchange.xforce.ibmcloud.com/vulnerabilities/136151 • CWE-863: Incorrect Authorization •

CVSS: 5.4EPSS: 0%CPEs: 30EXPL: 0

CVE-2017-1767

https://notcve.org/view.php?id=CVE-2017-1767

IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152. IBM Business Process Manager 8.6 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=swg22012396 http://www.securityfocus.com/bid/103679 http://www.securitytracker.com/id/1040623 https://exchange.xforce.ibmcloud.com/vulnerabilities/136152 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 100EXPL: 0

CVE-2018-1384

https://notcve.org/view.php?id=CVE-2018-1384

IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138135. IBM Business Process Manager 8.6 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=swg22012604 http://www.securityfocus.com/bid/103681 http://www.securitytracker.com/id/1040624 https://exchange.xforce.ibmcloud.com/vulnerabilities/138135 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 59EXPL: 0

CVE-2017-1765

https://notcve.org/view.php?id=CVE-2017-1765

IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150. La versión 8.6 de IBM Business Process Manager podría permitir que un usuario autenticado con privilegios especiales revele información sensible sobre el servidor de la aplicación. IBM X-Force ID: 136150. • http://www.ibm.com/support/docview.wss?uid=swg22011844 http://www.securityfocus.com/bid/103678 http://www.securitytracker.com/id/1040622 https://exchange.xforce.ibmcloud.com/vulnerabilities/136150 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •