IBM Business Process Manager
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-41735 | 21.0.1 – < 21.0.3.1 ; 20.0.0.1 – < 20.0.0.2 ; 19.0.0.1 – < 19.0.0.3 | IBM Business Process Manager cross-site scripting | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-22361 | 8.6.0.0 ; 8.5.0.0 ; 8.5.0.201706 ; … | IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 1 | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-39046 | 8.5 ; 8.6 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain cl | MEDIUM 4.9 | 0.9 % | ||
| CVE-2021-38883 | 8.5 ; 8.6 | IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripti | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-29753 | 8.5 ; 8.6 | IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credential | MEDIUM 5.9 | 0.8 % | ||
| CVE-2021-29834 | 8.5 ; 8.6 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business | MEDIUM 6.4 | 0.5 % | ||
| CVE-2021-29751 | 8.5 ; 8.6 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obta | MEDIUM 4.3 | 0.9 % | ||
| CVE-2020-4794 | 8.6 | IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Ma | MEDIUM 5.4 | 0.8 % | ||
| CVE-2020-4531 | 8.0 ; 8.5 ; 8.6 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to ob | MEDIUM 5.3 | 1.4 % | ||
| CVE-2020-4530 | 8.0 ; 8.5 ; 8.6 | IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulne | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-4698 | 8.5 ; 8.6 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scriptin | MEDIUM 6.4 | 0.6 % | ||
| CVE-2020-4516 | 8.5 ; 8.6 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This | MEDIUM 5.4 | 0.8 % | ||
| CVE-2020-4557 | 8.5 ; 8.6 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. T | MEDIUM 5.4 | 0.6 % | ||
| CVE-2019-4669 | 8.6.0.0 ; 8.5.7.0 ; 8.6.0.0.CF2018.03 ; … | IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0 | MEDIUM 6.3 | 0.8 % | ||
| CVE-2019-4149 | 8.6.0.0 ; 8.5.6.0 ; 8.5.6.0CF2 ; … | IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018. | MEDIUM 5.4 | 0.7 % | ||
| CVE-2018-1674 | 8.5 ; 8.5.0.1 ; 8.5.5 ; … | IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send spe | HIGH 8.8 | 1.7 % | ||
| CVE-2018-1384 | 8.6 ; 8.6.0.CF201712 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i | MEDIUM 5.4 | 1.0 % | ||
| CVE-2017-1767 | 8.6 ; 8.6.0.CF201712 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i | MEDIUM 5.4 | 1.0 % | ||
| CVE-2017-1766 | 8.6 ; 8.6.0.CF201712 | Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM | MEDIUM 4.3 | 0.7 % | ||
| CVE-2017-1765 | 8.6 | IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the applica | MEDIUM 4.3 | 1.4 % | ||
| CVE-2017-1756 | 8.6 | IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1358 | MEDIUM 4.0 | 0.4 % | ||
| CVE-2017-1769 | 8.6 | IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor | HIGH 8.8 | 1.0 % | ||
| CVE-2017-1628 | 8.6.0.0 | IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect au | MEDIUM 6.5 | 1.8 % |