Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

54 records

Vendor: IBM Component: Business Automation Workflow Clear all filters
TI-2026-10881 CVE-2026-12730 · GHSA-6486-8hjq-q8vf

Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

Priority LOW 17

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00166 Published 2026-08-05 No fix listed CWE-297
TI-2026-00967 CVE-2026-1248 · GHSA-gq2r-qh4m-2g7x

IBM Business Automation Workflow information leak

Priority LOW 19

IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00219 Published 2026-05-27 No fix listed CWE-209
TI-2025-11979 CVE-2025-13096 · GHSA-gpf2-rxq3-v5rj

XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

Priority LOW 32

IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an X…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00508 Published 2026-02-02 No fix listed CWE-918
TI-2025-24659 CVE-2025-36054 · GHSA-954p-ff4g-qrwj

Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -

Priority LOW 27

IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 thr…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-11-06 No fix listed CWE-79
TI-2025-01285 CVE-2025-1495 · GHSA-m588-qhfh-q4qg

IBM Business Automation Workflow missing authentication

Priority LOW 20

IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00263 Published 2025-05-03 No fix listed CWE-306
TI-2024-36284 CVE-2024-54179 · GHSA-349h-vrrw-f3cp

IBM Business Automation Workflow cross-site scripting

Priority LOW 24

IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00288 Published 2025-03-03 No fix listed CWE-79
TI-2024-28850 CVE-2024-43188 · GHSA-m58v-fvm4-hcrr

IBM Business Automation Workflow improper input validation

Priority LOW 22

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00324 Published 2024-09-18 No fix listed CWE-602
TI-2024-25595 CVE-2024-38321 · GHSA-f6fc-9fwc-q7rw

IBM Business Automation Workflow information disclosure

Priority LOW 29

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00417 Published 2024-08-03 No fix listed CWE-532
TI-2023-27840 CVE-2023-50947 · GHSA-gccr-qg9r-6mhw

IBM Business Automation Workflow cross-site scripting

Priority LOW 25

IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00414 Published 2024-02-04 No fix listed CWE-79
TI-2023-10441 CVE-2023-24957 · GHSA-hv6v-6qxh-92wf

IBM Business Automation Workflow cross-site scripting

Priority LOW 25

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00371 Published 2023-05-06 No fix listed CWE-79
TI-2022-21536 CVE-2022-43864 · GHSA-rpph-wv52-9mgp

IBM Business Automation Workflow information disclosure

Priority MEDIUM 43

IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0202 Published 2023-01-25 No fix listed CWE-22
TI-2022-20639 CVE-2022-42435 · GHSA-q38h-5r99-h68w

IBM Business Automation Workflow cross-site request forgery

Priority LOW 38

IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to exe…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00274 Published 2023-01-03 No fix listed CWE-352
TI-2022-20122 CVE-2022-41735 · GHSA-m58p-hgqc-5chg

IBM Business Process Manager cross-site scripting

Priority LOW 27

IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00411 Published 2022-12-07 Fixed in 21.0.3.1, 20.0.0.2 +1 CWE-79
TI-2022-18016 CVE-2022-38390 · GHSA-vc25-xf9v-8g8v

Cross-site scripting in IBM Business Automation Workflow

Priority LOW 25

Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00418 Published 2022-11-17 Fixed in 21.0.3.1, 20.0.0.2 +2 CWE-79
TI-2022-15957 CVE-2022-35279 · GHSA-839x-g2vq-gcpw

Cleartext storage of sensitive information in IBM Business Automation Workflow

Priority LOW 20

"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2022-11-03 No fix listed CWE-312
TI-2022-06683 CVE-2022-22361 · GHSA-27g5-8hjj-69w4

Cross-site request forgery in IBM Business Process Manager

Priority LOW 29

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0036 Published 2022-05-31 No fix listed CWE-352
TI-2021-16465 CVE-2021-39046 · GHSA-r6rq-vwqp-j4p3

Insufficiently protected credentials in IBM Business Automation Workflow

Priority LOW 24

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00926 Published 2022-03-18 No fix listed CWE-522
TI-2021-16348 CVE-2021-38893 · GHSA-cjm6-v8hr-j8c5

Cross-site scripting in IBM Cloud Pak for Automation

Priority LOW 26

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00708 Published 2021-12-21 No fix listed CWE-79
TI-2021-16343 CVE-2021-38883 · GHSA-595h-f5rf-8jr4

Cross-site scripting in IBM Business Process Manager

Priority LOW 25

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00495 Published 2021-12-17 No fix listed CWE-79
TI-2021-10527 CVE-2021-29878 · GHSA-gg2q-m7gx-p66r

Cross-site scripting in IBM Business Automation Workflow

Priority LOW 25

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00532 Published 2021-10-18 No fix listed CWE-79
Load more