Skip to content
OpenAdvisories
High WID-SEC-2024-0068 12 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen

Published Jan 11, 2024 · Updated Nov 11, 2024 · Revision 3 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 12

  • Critical 9.8
    CVE-2020-10683

    dom4j allows External Entities by default which might enable XXE attacks

    dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any applicatio…

    dom4j:dom4j dom4j dom4j org.dom4j:dom4j Debian Ubuntu Maven
  • Critical 9.1
    CVE-2021-23926

    XMLBeans XML Entity Expansion

    The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

    Apache Software Foundation Apache XMLBeans org.apache.xmlbeans:xmlbeans xmlbeans Debian Ubuntu Maven
  • High 7.5
    CVE-2012-0881 EPSS 17%

    Denial of service in Apache Xerces2

    Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

    xerces:xercesImpl libxerces2-java libxerces2-java Debian Ubuntu Maven
  • High 7.5
    CVE-2017-12626 EPSS 10%

    Denial of Service in Apache POI

    Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI …

    Apache Software Foundation Apache POI libapache-poi-java libapache-poi-java Debian Ubuntu Maven
  • High 7.5
    CVE-2018-1000632

    Dom4j contains a XML Injection vulnerability

    dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable vi…

    dom4j:dom4j dom4j dom4j org.dom4j:dom4j Debian Ubuntu Maven
  • High 7.5
    CVE-2021-33813 EPSS 19%

    XML External Entity (XXE) Injection in JDOM

    An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

    libjdom2-java org.jdom:jdom jdom2 libjdom1-java Debian Ubuntu Azure Linux Maven
  • Medium 6.5
    CVE-2022-23437 EPSS 12%

    Infinite loop within Apache XercesJ xml parser

    There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…

    Apache Software Foundation Apache Xerces xerces:xercesImpl libxerces2-java Debian Ubuntu Azure Linux Maven
  • Medium 5.5
    CVE-2017-5644

    Improper Restriction of Recursive Entity References in DTDs in Apache POI

    Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

    Apache Software Foundation Apache POI libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven
  • Medium 5.5
    CVE-2019-12415

    Improper Restriction of XML External Entity Reference in Apache POI

    In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…

    libapache-poi-java org.apache.poi:poi libapache-poi-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2020-14338

    Improper Input Validation in Xerces

    A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validat…

    xerces:xercesImpl Maven
  • Medium —
    CVE-2009-2625 EPSS 30%

    Denial of service in Apache Xerces2

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and applic…

    xerces:xercesImpl libxerces2-java Debian Maven
  • High —
    CVE-2013-4002 Public exploit EPSS 25%

    Missing XML Validation in Apache Xerces2

    XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u6…

    xerces:xercesImpl Maven

Revision history

  1. #3

    Prüfung Produkteintragung

  2. #2

    Neue Updates von IBM aufgenommen

  3. #1

    Initiale Fassung

References