Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
124 results · page 1 of 3
Oct 28, 2026The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution CVE-2026-78674 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.8
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
- Product
- Enterprise Integrator (BPS profile)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 20, 2026Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).CVE-2026-91213 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Business Process Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instaCVE-2026-58448 · Other software · YunaiV · reported by VulnCheckHigh 7.1
yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow.CVE-2026-47833 · Other software · Cloud Foundry Foundation · reported by security@vmware.comMedium 6.9
setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job. Affected versions: bpm-release, all versions prior to v1.4.30.
- Product
- bpm-release
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards.CVE-2026-40942 · Other software · datasharingframework · reported by GitHubMedium 6.3
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
- Product
- dsf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards.CVE-2026-40939 · Other software · datasharingframework · reported by GitHubMedium 6.8
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.
- Product
- dsf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.CVE-2026-3207 · Other software · TIBCO · reported by security@tibco.comHigh 8.7
Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100CVE-2025-11848 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.9
A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
- Product
- VMG3625-T50B firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX310CVE-2025-11847 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.9
A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
- Product
- VMG3625-T50B firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel CVE-2025-11846 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.9
A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
- Product
- VMG3625-T50B firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the CVE-2025-11845 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.9
A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.
- Product
- VMG3625-T50B firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of oCVE-2025-67282 · Other software · Tim-solutions · reported by MITREMedium 5.4
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access work items of other user, modify restricted content in workflows, modify the applications logo and manipulate the profile of other user.
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Jan 9, 2026In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the databaCVE-2025-67281 · Other software · Tim-solutions · reported by MITREMedium 5.4
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Jan 9, 2026In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwordCVE-2025-67280 · Other software · Tim-solutions · reported by MITREMedium 5.4
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Jan 9, 2026An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashesCVE-2025-67279 · Other software · Tim-solutions · reported by MITREMedium 5.3
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Jan 9, 2026An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP requestCVE-2025-67278 · Other software · Tim-solutions · reported by MITREMedium 6.5
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Dec 29, 2025BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shCVE-2025-15228 · Other software · WELLTEND TECHNOLOGY · reported by twcert@cert.org.twCritical 9.3
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- BPMFlowWebkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 29, 2025BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path TraveCVE-2025-15227 · Other software · WELLTEND TECHNOLOGY · reported by twcert@cert.org.twHigh 8.7
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
- Product
- BPMFlowWebkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 5, 2025A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0.CVE-2025-5680 · Other software · Shenzhen Dashi Tongzhou Information Technology · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the function executeScript of the file /src/main/java/com/dstz/sys/rest/controller/SysScriptController.java of the component Groovy Script Handler. The manipulation of the argument script leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AgileBPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0.CVE-2025-5679 · Other software · Shenzhen Dashi Tongzhou Information Technology · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStrByFreeMarker of the file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation of the argument str leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AgileBPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.CVE-2025-45854 · Other software · JEHc · reported by MITRECritical 10
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
- Product
- JEHC-BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
May 21, 2025Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of tCVE-2025-2261 · Other software · TIBCO Software Inc · reported by security@tibco.comHigh 7
Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to exCVE-2025-26157 · Other software · Darkseid · reported by MITREMedium 5.9
A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to execute arbitrary code via the name POST request parameter.
- Product
- Beauty Parlour Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.CVE-2024-46481 · Other software · Venki · reported by MITREHigh 7.2
The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.
- Product
- Supravizio BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlCVE-2024-46480 · Other software · Venki · reported by MITREHigh 8.4
An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system.
- Product
- Supravizio BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability.CVE-2024-46479 · Other software · Venki · reported by MITRECritical 9.9
Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution.
- Product
- Supravizio BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0.CVE-2024-12235 · Other software · Shenzhen Dashi Tongzhou Information Technology · reported by VulDBMedium 5.3
A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file \agile-bpm-basic-master\ab-auth\ab-auth-spring-security-oauth2\src\main\java\com\dstz\auth\filter\AuthorizationTokenCheckFilter.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AgileBPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)CVE-2024-9197 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.9
A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.
- Product
- VMG3625-T50B firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2024bpmn.io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neville.lugton bpmn.io bpmnio allows Stored XSS.This issue affects bpmn.io: from n/a through <= 1.0.
- Product
- bpmn.io
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update bpmn.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2024The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privilegeCVE-2024-9971 · Other software · NewType · reported by twcert@cert.org.twHigh 8.8
The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.
- Product
- FlowMaster BPM Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2024The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability.CVE-2024-9970 · Other software · NewType · reported by twcert@cert.org.twHigh 8.8
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- Product
- FlowMaster BPM Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 24, 2024Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code IncCVE-2024-5683 · Other software · Next4Biz CRM & BPM Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
- Product
- Business Process Manangement (BPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 24, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (CVE-2024-4754 · Other software · Next4Biz CRM & BPM Software · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
- Product
- Business Process Manangement (BPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .CVE-2024-35086 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 20, 2024The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remote attacker to cause CVE-2023-37929 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 6.5
The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remote attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
- Product
- V5.50(ABPM.8)C0 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.CVE-2024-33144 · Other software · j2eefast · reported by MITREHigh 8.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source.CVE-2023-40310 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.
- Product
- SAP PowerDesigner Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2023SmartBPM.NET component has a vulnerability of path traversal within its file download function.CVE-2023-37288 · Other software · SmartSoft · reported by twcert@cert.org.twMedium 6.5
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
- Product
- SmartBPM.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 9, 2023SmartBPM.NET has a vulnerability of using hard-coded authentication key.CVE-2023-37287 · Other software · SamrtSoft · reported by twcert@cert.org.twCritical 9.1
SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.
- Product
- SmartBPM.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 9, 2023SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key.CVE-2023-37286 · Other software · SamrtSoft · reported by twcert@cert.org.twCritical 9.8
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
- Product
- SmartBPM.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 2, 2023It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM.CVE-2023-25780 · Other software · Status Internet Co.,Ltd. · reported by twcert@cert.org.twMedium 5.7
It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.
- Product
- PowerBPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 10, 2022Agentflow BPM enterprise management system has improper authentication.CVE-2022-39038 · Other software · FLOWRING · reported by twcert@cert.org.twHigh 8.8
Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.
- Product
- Agentflow BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflowring.comtwcert.org.tw
Nov 10, 2022Agentflow BPM file download function has a path traversal vulnerability.CVE-2022-39037 · Other software · FLOWRING · reported by twcert@cert.org.twHigh 7.5
Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
- Product
- Agentflow BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflowring.comtwcert.org.tw
Nov 10, 2022The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs.CVE-2022-39036 · Other software · FLOWRING · reported by twcert@cert.org.twCritical 9.8
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.
- Product
- Agentflow BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflowring.comtwcert.org.tw
Jul 19, 2022Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input.CVE-2022-32458 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twHigh 7.5
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 19, 2022Digiwin BPM has inadequate filtering for URL parameter.CVE-2022-32457 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twMedium 5.3
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 19, 2022Digiwin BPM’s function has insufficient validation for user input.CVE-2022-32456 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twCritical 9.8
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
May 17, 2022The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult toCVE-2022-22775 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.1
The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JCVE-2022-22771 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.
- Product
- TIBCO JasperReports Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021A flaw was found in the BPMN editor in version jBPM 7.51.0.Final.CVE-2021-20306 · Other software · Redhat · reported by Red HatMedium 4.3
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
- Product
- Descision Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.