Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2013-6465

Workbench: Multiple stored XSS issues

Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.

CVSS 3.0 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jbpm
CVE-2014-3682

jbpm-designer: XXE in BPMN2 import

XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jbpm-designer
CVE-2014-8125

jBPM: BPMN2 file processing XXE in Process Execution

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Drools Jboss Bpms Jboss Brms and 1 more
CVE-2021-20306

Business-central: Ruleflow Groups from other projects displayed on BPMN editor despite user having no access to those projects

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Descision Manager Jbpm Process Automation
CVE-2017-7545

jbpmmigration: XXE vulnerability in XmlUtils

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Decision Manager Jboss Bpm Suite Jboss Bpms and 2 more