Known vulnerabilities in IBM Business Process Manager

Vendor: IBM Corporation
Software: IBM Business Process Manager
Software CPE: cpe:2.3:a:ibm_corporation:ibm_business_process_manager:*:*:*:*:*:*:*:*
Website: https://www.ibm.com/us-en
Total vulnerabilities: 33
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting IBM Business Process Manager IBM Business Process Manager is affected by 33 known vulnerabilities: 1 critical, 6 high, 14 medium, 12 low Critical High Medium Low

Vulnerabilities (33)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU67526 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-29834		 CWE-79 Medium
No
No
 - 21.09.2022 SB2022092104
#VU64527 - Cross-Site Request Forgery (CSRF)
CVE-2022-22361		 CWE-352 Medium
No
No
 8.5.7 CF2017.06 21.06.2022 SB2022062103
SB2025012106
#VU61799 - Out-of-bounds write
CVE-2020-36518		 CWE-787 Medium
No
No
 - 01.04.2022 SB2022040113
SB2022040114
SB2022040115
and 147 more
#VU61391 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2022-0778		 CWE-835 Medium
Available
No
 - 15.03.2022 SB2022031520
SB2022031522
SB2022031611
and 238 more
#VU61254 - Use After Free
CVE-2021-22940		 CWE-416 Medium
No
No
 8.5.7.0 11.03.2022 SB2021081615
SB2022031104
SB2022060618
and 23 more
#VU61253 - Improper Certificate Validation
CVE-2021-22939		 CWE-295 Medium
No
No
 8.5.7.0 11.03.2022 SB2021081614
SB2022031104
SB2022060618
and 25 more
#VU60834 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-23450		 CWE-94 High
No
No
 8.5.7.CF201706, 8.6.0.CF201803 23.02.2022 SB2022022311
SB2022022312
SB2022031011
and 41 more
#VU59551 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21824		 CWE-94 Medium
No
No
 - 12.01.2022 SB2022011216
SB2022041205
SB2022060315
and 39 more
#VU59549 - Improper Validation of Certificate with Host Mismatch
CVE-2021-44532		 CWE-297 Medium
No
No
 - 12.01.2022 SB2022011216
SB2022041522
SB2022042806
and 36 more
#VU59548 - Improper Certificate Validation
CVE-2021-44531		 CWE-295 Medium
No
No
 - 12.01.2022 SB2022011216
SB2022032010
SB2022041522
and 35 more
#VU57498 - Improper input validation
CVE-2021-22931		 CWE-20 High
No
No
 8.5.7.0 19.10.2021 SB2021101945
SB2022020113
SB2022031104
and 28 more
#VU57487 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CVE-2021-35550		 CWE-300 Medium
No
No
 8.5.7 CF2017.06, 8.6.0.0 CF2018.03 19.10.2021 SB2021101939
SB2021101940
SB2021102101
and 102 more
#VU57496 - Improper input validation
CVE-2021-35603		 CWE-20 Low
No
No
 8.5.7 CF2017.06, 8.6.0.0 CF2018.03 19.10.2021 SB2021101939
SB2021101940
SB2021102101
and 112 more
#VU55560 - Use After Free
CVE-2021-22930		 CWE-416 High
No
No
 8.5.7.0 03.08.2021 SB2021080320
SB2021080324
SB2021080325
and 35 more
#VU54625 - Incorrect Default Permissions
CVE-2021-22921		 CWE-276 Low
No
No
 8.5.7.0 08.07.2021 SB2021100417
SB2022031104
SB2022060315
and 7 more
#VU54624 - Out-of-bounds read
CVE-2021-22918		 CWE-125 Medium
No
No
 8.5.7.0 08.07.2021 SB2021070819
SB2021072009
SB2021081123
and 40 more
#VU28583 - Improper input validation
CVE-2014-3004		 CWE-20 Medium
Available
No
 - 04.06.2020 SB20200114160
SB2022110305
SB2023061628
and 2 more
#VU11268 - Deserialization of Untrusted Data
CVE-2018-7489		 CWE-502 High
No
No
 - 26.03.2018 SB2018021604
SB2018041910
SB2018050306
and 27 more
#VU10610 - Deserialization of Untrusted Data
CVE-2018-5968		 CWE-502 High
No
No
 - 16.02.2018 SB2018021604
SB2018021605
SB2018051725
and 13 more
#VU10257 - Deserialization of Untrusted Data
CVE-2017-17485		 CWE-502 High
No
No
 - 26.01.2018 SB2017121218
SB2018021605
SB2018051725
and 23 more


Showing elements 1 - 20 out of 33