IBM Business Process Manager vulnerabilities

88 CVEs affecting IBM Business Process Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22361, published 2022-05-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1884, published 2015-06-28. Medium severity, CVSS 4.0. EPSS: 2.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition…
CVE-2019-4424, published 2019-08-20. High severity, CVSS 8.2. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could…
CVE-2015-1961, published 2015-07-13. High severity, CVSS 9.0. EPSS: 2.4% chance of exploitation in the next 30 days. The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated…
CVE-2014-6182, published 2014-12-17. Medium severity, CVSS 4.0. EPSS: 2.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in an export function in the Process Center in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to…
CVE-2014-3076, published 2014-08-11. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.
CVE-2017-1527, published 2017-09-26. High severity, CVSS 8.1. EPSS: 2% chance of exploitation in the next 30 days. IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…
CVE-2017-1628, published 2017-11-27. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks.
CVE-2014-6176, published 2014-12-16. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL…
CVE-2018-1885, published 2019-04-08. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request. IBM X-Force ID: 152020.
CVE-2015-0158, published 2015-03-24. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers…

Latest

CVE-2022-22361, published 2022-05-31. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers…
CVE-2021-39046, published 2022-03-18. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM…
CVE-2021-38900, published 2021-12-21. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access…
CVE-2021-38893, published 2021-12-21. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed…
CVE-2021-38883, published 2021-12-17. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
CVE-2021-29753, published 2021-11-05. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to…
CVE-2021-29834, published 2021-09-29. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored…
CVE-2021-29751, published 2021-06-28. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under…
CVE-2020-4794, published 2020-12-21. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain…
CVE-2020-4531, published 2020-09-25. Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error…