Red Hat JBoss Bpm Suite vulnerabilities

18 CVEs affecting Red Hat JBoss Bpm Suite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-19362, published 2019-01-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2018-19362, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19361, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19360, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2016-4999, published 2016-08-05. Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days. SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to…
CVE-2017-7545, published 2018-07-26. Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days. It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files…
CVE-2015-1818, published 2015-08-11. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote…
CVE-2016-6344, published 2016-09-07. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via…
CVE-2013-6468, published 2014-04-10. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or…
CVE-2017-7463, published 2018-07-27. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML…

Latest

CVE-2016-6343, published 2018-10-31. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to…
CVE-2016-8608, published 2018-08-01. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges…
CVE-2017-2674, published 2018-07-27. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote,…
CVE-2017-2658, published 2018-07-27. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which…