Medium WID-SEC-2023-1369 6 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Jun 5, 2023 · Updated Jun 5, 2023 · de-DE

Vendor: IBM Product: Business Automation Workflow Enterprise Service Bus 22.0.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 6

Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

bootstrap twitter-bootstrap3 twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch bootstrap Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-20676

XSS vulnerability that affects bootstrap

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

twitter-bootstrap3 bootstrap twitter-bootstrap3 bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-20677

bootstrap Cross-site Scripting vulnerability

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2019-8331 Public exploit EPSS 16%

Bootstrap Vulnerable to Cross-Site Scripting

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Feb 20, 2019

Revision history

2023-06-05 #1
Initiale Fassung

References

IBM Security Bulletin vom 2023-06-05
https://www.ibm.com/support/pages/node/7001347