Vulnerabilities

Filters

Reset all

2 selected

88 records

Sort

Vendor: IBM Component: Business Process Manager Clear all filters

TI-2022-06683 CVE-2022-22361 · GHSA-27g5-8hjj-69w4

Cross-site request forgery in IBM Business Process Manager

LOW 29

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0036 Published 2022-05-31 No fix listed CWE-352

TI-2021-16465 CVE-2021-39046 · GHSA-r6rq-vwqp-j4p3

Insufficiently protected credentials in IBM Business Automation Workflow

LOW 24

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00926 Published 2022-03-18 No fix listed CWE-522

TI-2021-16353 CVE-2021-38900 · GHSA-88fr-hq55-5pw4

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0…

LOW 31

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01167 Published 2021-12-21 No fix listed

TI-2021-16348 CVE-2021-38893 · GHSA-cjm6-v8hr-j8c5

Cross-site scripting in IBM Cloud Pak for Automation

LOW 26

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00708 Published 2021-12-21 No fix listed CWE-79

TI-2021-16343 CVE-2021-38883 · GHSA-595h-f5rf-8jr4

Cross-site scripting in IBM Business Process Manager

LOW 25

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00495 Published 2021-12-17 No fix listed CWE-79

TI-2021-10429 CVE-2021-29753 · GHSA-rggj-vgc7-hj7v

Cleartext transmission of sensitive information in IBM Business Process Manager

LOW 28

IBM Business Automation Workflow 18.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00802 Published 2021-11-05 No fix listed CWE-319

TI-2021-10496 CVE-2021-29834 · GHSA-q57v-qj3r-wqqc

Cross-site scripting in IBM Business Automation Workflow

LOW 25

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00495 Published 2021-09-29 No fix listed CWE-79

TI-2021-10427 CVE-2021-29751 · GHSA-5w9g-vrj4-xwgh

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager…

LOW 22

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0085 Published 2021-06-28 No fix listed

TI-2020-04063 CVE-2020-4794 · GHSA-jq8v-8c7p-26p2

Incorrect authorization in IBM Automation Workstream Services

LOW 26

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or c…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00849 Published 2020-12-21 No fix listed CWE-863

TI-2020-03860 CVE-2020-4531 · GHSA-2c29-84m2-9q27

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager…

LOW 27

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned i…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01426 Published 2020-09-25 No fix listed CWE-252

TI-2020-03859 CVE-2020-4530 · GHSA-hjhv-rf4c-xwpv

Cross-site scripting in IBM Business Process Manager

LOW 25

IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2020-09-15 No fix listed CWE-79

TI-2020-03998 CVE-2020-4698 · GHSA-2jhm-h3h6-8pq5

Cross-site scripting in IBM Business Process Manager

LOW 25

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2020-09-08 No fix listed CWE-79

TI-2020-03849 CVE-2020-4516 · GHSA-fpqw-rp77-mwjr

Cross-site scripting in IBM Business Process Manager

LOW 26

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00813 Published 2020-09-08 No fix listed CWE-79

TI-2020-03882 CVE-2020-4557 · GHSA-gxpm-7hmf-39ph

Cross-site scripting in IBM Business Process Manager

LOW 25

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2020-06-29 No fix listed CWE-79

TI-2020-03861 CVE-2020-4532 · GHSA-jf7x-r4m4-rqc9

Information disclosure through error messages in IBM Business Process Manager Express

LOW 27

IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technica…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01299 Published 2020-06-17 No fix listed CWE-209

TI-2020-03833 CVE-2020-4490 · GHSA-9cmc-3866-78p4

IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5…

LOW 29

IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0086 Published 2020-05-29 No fix listed

TI-2020-03805 CVE-2020-4446 · GHSA-qf8r-xr22-fxr5

Incorrect authorization in IBM Business Process Manager Standard

LOW 22

IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00898 Published 2020-05-06 No fix listed CWE-863

TI-2019-03410 CVE-2019-4669 · GHSA-r67h-45wp-63r3

SQL injection in IBM Business Automation Workflow

LOW 30

IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00835 Published 2020-02-27 No fix listed CWE-89

TI-2019-03100 CVE-2019-4149 · GHSA-cvp3-pjrm-gpxx

Cross-site scripting in IBM Business Automation Workflow

LOW 26

IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00679 Published 2019-09-05 No fix listed CWE-79

TI-2019-03267 CVE-2019-4424 · GHSA-pgcf-289q-wwmj

XML external entity injection in IBM Business Automation Workflow

MEDIUM 40

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02427 Published 2019-08-20 No fix listed CWE-611

TI-2019-03268 CVE-2019-4425 · GHSA-q78f-m77g-r2gf

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to…

LOW 28

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01157 Published 2019-08-20 No fix listed

TI-2019-03259 CVE-2019-4410 · GHSA-q835-38v5-g9g9

Cross-site scripting in IBM Business Automation Workflow

LOW 26

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00968 Published 2019-07-01 No fix listed CWE-79

TI-2019-03134 CVE-2019-4204 · GHSA-gpf8-gj7j-6m8h

Cross-site scripting in IBM Business Automation Workflow

LOW 26

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00938 Published 2019-05-10 No fix listed CWE-79

TI-2019-03027 CVE-2019-4045 · GHSA-89mv-qjvv-fjxc

IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and…

LOW 22

IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00873 Published 2019-04-08 No fix listed

TI-2018-01730 CVE-2018-2000 · GHSA-j83f-fmmw-wc95

Cross-site request forgery in IBM Business Automation Workflow

LOW 39

IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trus…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00763 Published 2019-04-08 No fix listed CWE-352