BP
Product
Business Process Manager
88
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 51Low 2
Watch
Add Business Process Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4446 | 4.3 | May 6 | IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the… Affected: 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.7.0; 8.6.0.0 |
| CVE-2019-4045 | 4.3 | Apr 8 | IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features Affected: 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.0; 8.5.7.0; +4 more |
| CVE-2018-1999 | 4.3 | Apr 8 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in… Affected: 8.0.0.0 through 8.0.1.3; 8.5.0.0 through 8.5.0.2; 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.0; +4 more |
| CVE-2017-1766 | 4.3 | Mar 30 | Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to Affected: 8.5.5.0; 8.5.6.0; 8.5.6.0; 8.5.6.1; 8.5.6.2; 8.5.7.0; +29 more |
| CVE-2017-1765 | 4.3 | Mar 30 | IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +34 more |
| CVE-2015-7463 | 4.3 | Mar 15 | IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +9 more |
| CVE-2015-7454 | 4.3 | Mar 21 | Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2,… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +11 more |
| CVE-2017-1756 | 3.3 | Mar 30 | IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +34 more |
| CVE-2017-1346 | 2.5 | Sep 25 | IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-4955 | – | Oct 3 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 before 8.5.6.0 CF1… Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; +29 more |
| CVE-2015-1904 | – | Aug 1 | IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management… Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.0; +21 more |
| CVE-2015-1906 | – | Jul 21 | Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-1905 | – | Jul 21 | The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-1961 | – | Jul 13 | The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; 7.5.0.1; +33 more |
| CVE-2015-1884 | – | Jun 28 | Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-0193 | – | May 30 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-0156 | – | May 25 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; +34 more |
| CVE-2015-0158 | – | Mar 24 | Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0… Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.0; +18 more |
| CVE-2015-0106 | – | Mar 24 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and… Affected: 7.5.0.0; 7.5.0.0; 7.5.0.0; 7.5.0.1; 7.5.0.1; 7.5.0.1; +33 more |
| CVE-2015-0105 | – | Mar 24 | Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows… Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.0; +18 more |
| CVE-2015-0103 | – | Mar 24 | Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through… Affected: 8.0.0.0; 8.0.0.0; 8.0.0.0; 8.0.1.0; 8.0.1.0; 8.0.1.0; +18 more |
| CVE-2014-6139 | – | Feb 13 | The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform… Affected: 8.0.1.3; 8.5.0.1; 8.5.5.0 |
| CVE-2014-8914 | – | Jan 21 | Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated… Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +2 more |
| CVE-2014-8913 | – | Jan 21 | Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated… Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +2 more |
| CVE-2014-6173 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated… Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +2 more |
| CVE-2014-6182 | – | Dec 17 | Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote… Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +2 more |
| CVE-2014-4844 | – | Dec 17 | The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-6176 | – | Dec 16 | IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 8.0.0.0; 8.0.1.0; +6 more |
| CVE-2014-6101 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in the redirect-login feature in IBM Business Process Manager (BPM) Advanced 7.5 through 8.5.5 allows remote attackers to inject arbitrary… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-4802 | – | Oct 7 | The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in… Affected: 8.0.0.0; 8.0.1.0; 8.0.1.1; 8.0.1.2; 8.0.1.3; 8.5.0.0; +2 more |
| CVE-2014-4759 | – | Sep 4 | An unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager (BPM) 8.5.x through 8.5.5 allows remote authenticated users to obtain sensitive… Affected: 8.5.0.0; 8.5.0.1; 8.5.5.0 |
| CVE-2014-4758 | – | Sep 4 | IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-3075 | – | Sep 4 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-3087 | – | Aug 17 | callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-3076 | – | Aug 11 | IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page Affected: 8.5.0.0; 8.5.0.1; 8.5.5.0 |
| CVE-2014-0957 | – | Jul 18 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +6 more |
| CVE-2014-0908 | – | Apr 10 | The User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.2, and 8.5.x through 8.5.0.1 does not verify authorization for… Affected: 7.5.0.0; 7.5.0.1; 7.5.1.0; 7.5.1.1; 7.5.1.2; 8.0.0.0; +5 more |
| CVE-2013-0581 | – | Jul 6 | Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject… Affected: 7.5.1.0; 7.5.1.1; 8.0.0.0; 8.0.1.0 |