CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0CVE-2013-6465
https://notcve.org/view.php?id=CVE-2013-6465
Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs. Múltiples vulnerabilidades Cross-Site Scripting (XSS) en JBPM KIE Workbench 6.0.x permiten que los usuarios autenticados remotos inyecten scripts web o HTML arbitrarios a través de vectores relacionados con las entradas HTML de nombres de tareas. • https://bugzilla.redhat.com/show_bug.cgi?id=1048380 https://github.com/kiegroup/jbpm-wb/commit/4818204506e8e94645b52adb9426bedfa9ffdd04 https://github.com/kiegroup/jbpm-wb/compare/6.0.x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8125 – jBPM: BPMN2 file processing XXE in Process Execution
https://notcve.org/view.php?id=CVE-2014-8125
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file. Vulnerabilidad de entidad externa XML (XXE) en Drools and jBPM anterior a 6.2.0 permite a atacantes remotos leer ficheros arbitrarios o posiblemente tener otro impacto no especificado a través de un fichero BPMN2 manipulado. It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks. • http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html https://bugzilla.redhat.com/show_bug.cgi?id=1169553 https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3 https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5 https://access.redhat.com/security/cve/CVE-2014-8125 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 2%CPEs: 3EXPL: 0CVE-2014-3682 – jbpm-designer: XXE in BPMN2 import
https://notcve.org/view.php?id=CVE-2014-3682
XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file. Vulnerabilidad de entidad externa XML (XXE) en la función JBPMBpmn2ResourceImpl en designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java en jbpm-designer 6.0.x y 6.2.x permite a atacantes remotos leer ficheros arbitrarios y posiblemenete tener otro impacto no especificado mediante la importación de un fichero BPMN2 manipulado. An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. • http://rhn.redhat.com/errata/RHSA-2015-0234.html http://rhn.redhat.com/errata/RHSA-2015-0235.html https://github.com/droolsjbpm/jbpm-designer/commit/5641588c730cc75dc3b76c34b76271fbd407fb84 https://github.com/droolsjbpm/jbpm-designer/commit/69d8f6b7a099594bd0536f88d528753875857088 https://github.com/droolsjbpm/jbpm-designer/commit/be3968d51299f6de0011324be60223ede49ecb1c https://github.com/droolsjbpm/jbpm-designer/commit/e4691214a100718c3b1c9b93d4db466672ba0be3 https://access.redhat.com/security/cve/CVE-2014-3682 https://bugzilla.redhat.com&#x • CWE-611: Improper Restriction of XML External Entity Reference •