Skip to content
OpenAdvisories
Medium WID-SEC-2026-0273 4 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen

Published Feb 1, 2026 · Updated Feb 3, 2026 · Revision 2 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um einen SQL-Injection Angriff durchzuführen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 4

  • High 7.3
    CVE-2025-5878 Public exploit

    ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

    A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initia…

    ESAPI esapi-java-legacy libowasp-esapi-java libowasp-esapi-java Debian Ubuntu
  • High 7.1
    CVE-2025-13096

    XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

    IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) atta…

    IBM Business Automation Workflow containers Business Automation Workflow traditional
  • Medium 6.4
    CVE-2025-36436

    Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

    IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007  is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to emb…

    IBM Cloud Pak for Business Automation
  • Medium 5.3
    CVE-2025-57352

    min-document vulnerable to prototype pollution

    A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the __proto__ property, an attacker can manipulate t…

    opensearch-dashboards-3-alerting-dashboards-plugin grafana-image-renderer min-document node-min-document Debian Ubuntu Wolfi npm

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-206752

  2. #1

    Initiale Fassung

References