JB
Product
Jboss Bpm Suite
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 2Medium 9Low 0
Watch
Add Jboss Bpm Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-19361 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 6.4.11 |
| CVE-2018-19362 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 6.4.11 |
| CVE-2018-19360 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 6.4.11 |
| CVE-2015-7501 | 9.8 | Nov 9 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;… Affected: 6.0.0 |
| CVE-2016-4999 | 9.8 | Aug 5 | SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows… Affected: 6.0.0; 6.0.1; 6.0.3; 6.1; 6.1.2 |
| CVE-2016-5401 | 8.8 | Apr 20 | Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances… Affected: 6.0.0 |
| CVE-2016-7034 | 8.8 | Sep 7 | The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for… Affected: 6.3.2 |
| CVE-2017-2658 | 6.5 | Jul 27 | It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in… Affected: before 6.4.2 |
| CVE-2017-7545 | 6.5 | Jul 26 | It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files Affected: 6.4 |
| CVE-2017-7463 | 6.1 | Jul 27 | JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload Affected: 6.0.0 before 6.4.3 |
| CVE-2016-7033 | 6.1 | Sep 7 | Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or… Affected: 6.3.2 |
| CVE-2016-6343 | 5.4 | Oct 31 | JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder Affected: 6.0.0 before 6.4.2 |
| CVE-2016-8608 | 5.4 | Aug 1 | JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor Affected: 6.0.0 |
| CVE-2017-2674 | 5.4 | Jul 27 | JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central Affected: 6.0.0 before 6.4.3 |
| CVE-2016-5398 | 5.4 | Oct 3 | Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or… Affected: through 6.3.2 |
| CVE-2016-6344 | 5.3 | Sep 7 | Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially… Affected: 6.3 |
| CVE-2015-1818 | – | Aug 11 | XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before… Affected: through 6.1.0 |
| CVE-2013-6468 | – | Apr 10 | JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX… Affected: 6.0.0 |
Showing 18