Login Request a demo
BP
Product
Business Process Manager
by Ibm · last CVE May 31, 2022
88
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities88In the news0Timeline
Severity mix
Critical 0High 6Medium 51Low 2
Severity
All severities88Critical0High6Medium51Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Business Process Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-2000
8.8
1%
Apr 8
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
Affected: 8.6.0.0; 8.6.0.0
CVE-2018-1674
8.8
2%
Sep 20
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection
Affected: 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.5.0; 8.5.5.0; 8.5.5.0; 8.5.6.0; +8 more
CVE-2017-1769
8.8
1%
Jan 24
IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
Affected: 8.6.0.0
CVE-2017-1539
8.8
2%
Sep 26
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2019-4424
8.2
2%
Aug 20
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
Affected: 7.5.0.0 through 7.5.1.2; 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; +10 more
CVE-2017-1527
8.1
2%
Sep 26
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2015-7441
6.8
1%
Jan 1
Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through…
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; 7.5.0.1; +34 more
CVE-2022-22361
6.5
0%
May 31
IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation…
Affected: 8.5.0.0 through 8.5.0.201706; 8.6.0.0 through 8.6.0.201803
CVE-2021-38900
6.5
1%
Dec 21
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to…
Affected: 8.5.0.0; 8.6.0.0
CVE-2018-1997
6.5
1%
Apr 8
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack
Affected: 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.0; 8.5.7.0; 8.5.7.0; +2 more
CVE-2017-1628
6.5
2%
Nov 27
IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks
Affected: 8.6.0.0
CVE-2015-0110
6.5
1%
Sep 15
IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access…
Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +7 more
CVE-2016-0349
6.5
1%
Jun 30
IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update…
Affected: 8.5.6.0; 8.5.7.0
CVE-2019-4669
6.3
1%
Feb 27
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to…
Affected: 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; +3 more
CVE-2020-4490
6.1
1%
May 29
IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse…
Affected: 8.0.0.0; 8.5.0.0; 8.6.0.0
CVE-2018-1848
6.1
1%
Dec 14
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting
Affected: 7.5.0.0 through 7.5.1.2; 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; +10 more
CVE-2015-0101
6.1
1%
Aug 28
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express…
Affected: 7.5; 7.5.0.1; 7.5.1; 7.5.1.1; 7.5.1.2; 8.0; +33 more
CVE-2016-9693
6.1
1%
Mar 7
IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2015-8524
6.1
1%
Feb 29
Cross-site scripting (XSS) vulnerability in Process Portal in IBM Business Process Manager 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows…
Affected: 8.5.0.0; 8.5.0.0; 8.5.0.0; 8.5.0.1; 8.5.0.1; 8.5.0.1; +12 more
CVE-2021-29753
5.9
1%
Nov 5
IBM Business Automation Workflow 18
Affected: 8.5.0.0; 8.6.0.0
CVE-2019-4425
5.7
1%
Aug 20
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be…
Affected: 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.0; +9 more
CVE-2021-38893
5.4
1%
Dec 21
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting
Affected: 8.5.0.0; 8.5.5.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.6.0.0
CVE-2021-38883
5.4
0%
Dec 17
IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting
Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.7.0; +1 more
CVE-2021-29834
5.4
0%
Sep 29
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are…
Affected: 8.5.0.0; 8.6.0.0
CVE-2020-4794
5.4
1%
Dec 21
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated…
Affected: 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.1; 8.0.1.1; +32 more
CVE-2020-4530
5.4
1%
Sep 15
IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting
Affected: 8.0.0.0 before 8.0.1.0; 8.5.0.0 before 8.5.7.0; 8.6.0.0
CVE-2020-4698
5.4
1%
Sep 8
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting
Affected: 8.5.0.0; 8.5.0.0; 8.5.0.1; 8.5.0.1; 8.5.0.2; 8.5.0.2; +22 more
CVE-2020-4516
5.4
1%
Sep 8
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting
Affected: 8.5.0.0; 8.5.0.0; 8.5.0.1; 8.5.0.1; 8.5.0.2; 8.5.0.2; +22 more
CVE-2020-4557
5.4
1%
Jun 29
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting
Affected: 8.5.0.0; 8.6.0.0
CVE-2019-4149
5.4
1%
Sep 5
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0…
Affected: 8.5.6.0; 8.5.6.0; 8.5.6.0; 8.5.7.0; 8.5.7.0; 8.6.0.0; +2 more
CVE-2019-4410
5.4
1%
Jul 1
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting
Affected: 8.6.0.0; 8.6.0.0; 8.5.7.0; 8.5.7.0
CVE-2019-4204
5.4
1%
May 10
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting
Affected: 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; 8.5.7.0; +2 more
CVE-2018-1384
5.4
1%
Mar 30
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting
Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +34 more
CVE-2017-1767
5.4
1%
Mar 30
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting
Affected: 8.5.6.0; 8.5.6.1; 8.5.6.2; 8.5.7.0; 8.5.7.0; 8.5.7.0; +24 more
CVE-2017-1494
5.4
1%
Dec 20
IBM Business Process Manager 8.5 is vulnerable to cross-site scripting
Affected: 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.0; 8.5.7.0; 8.5.7.0; +4 more
CVE-2017-1531
5.4
1%
Sep 26
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2017-1530
5.4
1%
Sep 26
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2017-1425
5.4
1%
Sep 26
IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting
Affected: 8.0.1.1; 8.0.1.1; 8.0.1.1; 8.0.1.1; 8.5.7.0; 8.5.7.0; +2 more
CVE-2017-1424
5.4
1%
Sep 25
IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting
Affected: 8.5.7.0
CVE-2017-1140
5.4
1%
Jun 8
IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting
Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +8 more
CVE-2017-1159
5.4
1%
May 22
IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack
Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +13 more
CVE-2016-9731
5.4
1%
Feb 1
IBM Business Process Manager is vulnerable to cross-site scripting
Affected: 8.5.7.0
CVE-2016-3056
5.4
1%
Oct 14
Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote…
Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more
CVE-2016-5901
5.4
1%
Oct 5
Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative fix 2016.09 allows remote authenticated…
Affected: 8.5.6.0; 8.5.6.1; 8.5.6.2; 8.5.7.0
CVE-2016-0227
5.4
1%
Mar 3
Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5…
Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.0; +27 more
CVE-2020-4531
5.3
1%
Sep 25
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a…
Affected: 8.0.0.0; 8.5.0.0; 8.6.0.0
CVE-2020-4532
5.3
1%
Jun 17
IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain…
Affected: 8.5.5.0 before 8.5.7.0; 8.6.0.0
CVE-2018-1885
5.3
2%
Apr 8
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request
Affected: 7.5.0.0 through 7.5.1.2; 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; +5 more
CVE-2021-39046
4.9
1%
Mar 18
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a…
Affected: 8.5; 8.6
CVE-2021-29751
4.3
1%
Jun 28
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another…
Affected: 8.5.0.0; 8.6.0.0
Page 1 of 2 · 88 total
12