BA
Product
Business Automation Workflow traditional with Process Federation Server
54
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 47Low 1
Watch
Add Business Automation Workflow traditional with Process Federation Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-42435 | 8.8 | Jan 4 | IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request… Affected: 18.0.0; 18.0.1; 18.0.2; 19.0.1; 19.0.2; 19.0.3; +34 more |
| CVE-2018-2000 | 8.8 | Apr 8 | IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 18.0.0.0; 18.0.0.1 |
| CVE-2018-1674 | 8.8 | Sep 20 | IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection Affected: 18.0.0.0; 18.0.0.1 |
| CVE-2019-4424 | 8.2 | Aug 20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 18.0.0.0 through 19.0.0.2 |
| CVE-2022-43864 | 7.5 | Jan 26 | IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system Affected: 21.0.1 through 21.0.3.1; 20.0.0.1; 20.0.0.2; 22.0.1; 22.0.2 |
| CVE-2025-13096 | 7.1 | Feb 2 | XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow - Affected: V25.0.0 through V25.0.0-IF002; V24.0.1 through V24.0.1-IF005; V24.0.0 through V24.0.0-IF007 |
| CVE-2024-38321 | 6.5 | Aug 3 | IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an… Affected: 20.0.0.1; 20.0.0.2; 21.0.2; 21.0.3; 21.0.3; 21.0.3; +30 more |
| CVE-2022-22361 | 6.5 | May 31 | IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation… Affected: 19.0.0.1 through 19.0.0.3; 21.0.1 through 21.0.3; 18.0.0.0; 18.0.0.1; 20.0.0.1; 20.0.0.2 |
| CVE-2021-38900 | 6.5 | Dec 21 | IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to… Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 20.0.0.0; +1 more |
| CVE-2018-1997 | 6.5 | Apr 8 | IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2 |
| CVE-2019-4669 | 6.3 | Feb 27 | IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to… Affected: 18.0.0.1 through 19.0.0.3 |
| CVE-2025-36054 | 6.1 | Nov 6 | Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server - Affected: 24.0.0 through 24.0.1; 25.0.0 |
| CVE-2022-41735 | 6.1 | Dec 7 | IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting Affected: 19.0.0.1 through 19.0.0.3; 21.0.1 through 21.0.3.1; 20.0.0.1; 20.0.0.1; 20.0.0.2; 20.0.0.2; +19 more |
| CVE-2021-29835 | 6.1 | Oct 22 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0; 21.0.0.0 |
| CVE-2020-4490 | 6.1 | May 29 | IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse… Affected: 18.0.0.0; 19.0.0.0 |
| CVE-2018-1848 | 6.1 | Dec 14 | IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting Affected: 18.0.0.0; 18.0.0.1 |
| CVE-2021-29753 | 5.9 | Nov 5 | IBM Business Automation Workflow 18 Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0; 21.0.0.0 |
| CVE-2019-4425 | 5.7 | Aug 20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be… Affected: 18.0.0.0 through 19.0.0.2 |
| CVE-2025-36058 | 5.5 | Jan 20 | Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025 Affected: 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; +9 more |
| CVE-2025-36059 | 5.5 | Jan 20 | Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025 Affected: 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; +9 more |
| CVE-2020-4900 | 5.5 | Nov 30 | IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user Affected: 19.0.0.3 |
| CVE-2024-54179 | 5.4 | Mar 3 | IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting Affected: through 24.0.1; 24.0.0; 24.0.1 |
| CVE-2023-50947 | 5.4 | Feb 4 | IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting Affected: 19.0.0.1 through 19.0.0.3; 21.0.1 through 21.0.3.1; 20.0.0.1; 20.0.0.1; 20.0.0.2; 20.0.0.2; +26 more |
| CVE-2023-24957 | 5.4 | May 6 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site… Affected: 19.0.0.1 through 19.0.0.3; 20.0.0.1 before 21.0.3; 21.0.1 through 21.0.3.1; 22.0.1 before 22.0.2; 18.0.0.0; 18.0.0.1; +22 more |
| CVE-2022-38390 | 5.4 | Nov 17 | Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting Affected: 18.0.0.0 through 18.0.0.2; 19.0.0.1 through 19.0.0.3; 21.0.1 through 21.0.3.1; 20.0.0.1; 20.0.0.2; 22.0.1 |
| CVE-2021-38893 | 5.4 | Dec 21 | IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0; 21.0.0.0 |
| CVE-2021-38883 | 5.4 | Dec 17 | IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +5 more |
| CVE-2021-29878 | 5.4 | Oct 18 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +5 more |
| CVE-2021-29834 | 5.4 | Sep 29 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are… Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.1; 19.0.0.2; 19.0.0.3; +3 more |
| CVE-2021-29775 | 5.4 | Jun 28 | IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting Affected: 19.0.0.3; 20.0.0.0 |
| CVE-2020-4768 | 5.4 | Feb 11 | IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting Affected: 18.0.0.0 through 20.0.0.2 |
| CVE-2020-4794 | 5.4 | Dec 21 | IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated… Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +4 more |
| CVE-2020-4672 | 5.4 | Nov 16 | IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting Affected: 20.0.0.1 |
| CVE-2020-4530 | 5.4 | Sep 15 | IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting Affected: before 20.0.0.2 |
| CVE-2020-4698 | 5.4 | Sep 8 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +2 more |
| CVE-2020-4516 | 5.4 | Sep 8 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.0; 19.0.0.1; 19.0.0.2; +2 more |
| CVE-2020-4557 | 5.4 | Jun 29 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0 |
| CVE-2019-4426 | 5.4 | Dec 13 | The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting Affected: 19.0.0.0 through 19.0.0.3; 18.0.0.0 |
| CVE-2019-4149 | 5.4 | Sep 5 | IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0… Affected: 18.0.0.0 through 18.0.0.2 |
| CVE-2019-4410 | 5.4 | Jul 1 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting Affected: 18.0.0.0 through 19.0.0.1 |
| CVE-2019-4204 | 5.4 | May 10 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting Affected: 18.0.0.0 through 19.0.0.1 |
| CVE-2020-4531 | 5.3 | Sep 25 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a… Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0 |
| CVE-2020-4532 | 5.3 | Jun 17 | IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain… Affected: 18.0.0.1; 19.0.0.3 |
| CVE-2018-1885 | 5.3 | Apr 8 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2 |
| CVE-2024-43188 | 4.9 | Sep 18 | IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation Affected: 18.0.0.1 through 18.0.0.3; 19.0.0.1 through 19.0.0.3; 21.0.1 through 21.0.3.1; 20.0.0.1; 20.0.0.2; 22.0.1; +4 more |
| CVE-2021-39046 | 4.9 | Mar 18 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a… Affected: 18.0.0.0; 18.0.0.1; 18.0.0.2; 19.0.0.1; 19.0.0.2; 19.0.0.3; +3 more |
| CVE-2026-1248 | 4.3 | May 27 | IBM Business Automation Workflow information leak Affected: 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; +34 more |
| CVE-2025-1495 | 4.3 | May 3 | IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation Affected: 24.0.1; 24.0.1; 24.0.1 |
| CVE-2022-35279 | 4.3 | Nov 3 | "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version… Affected: 18.0.0.0 through 18.0.0.2; 19.0.0.0 through 19.0.0.3; 20.0.0.1; 20.0.0.1; 20.0.0.2; 20.0.0.2; +15 more |
| CVE-2021-29751 | 4.3 | Jun 28 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another… Affected: 18.0.0.0; 19.0.0.0; 20.0.0.0 |