Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
workflow vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2022-21567
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Suc...
Oracle Workflow
NA
CVE-2008-0463
Cross-site scripting (XSS) vulnerability in the Workflow 4.7.x prior to 4.7.x-1.2 and 5.x prior to 5.x-1.2 module for Drupal allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors involving node properties.
Drupal Workflow
8.8
CVSSv3
CVE-2018-2000
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an malicious user to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
Ibm Business Automation Workflow 18.0.0.1
Ibm Business Automation Workflow 18.0.0.0
Ibm Business Process Manager 8.6.0.0
7.5
CVSSv3
CVE-2016-15036
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to...
Deis Workflow Manager
4.3
CVSSv3
CVE-2020-26171
In tangro Business Workflow prior to 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
Tangro Business Workflow
6.5
CVSSv3
CVE-2020-26172
Every login in tangro Business Workflow prior to 1.18.1 generates the same JWT token, which allows an malicious user to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
Tangro Business Workflow
4.3
CVSSv3
CVE-2020-26173
An incorrect access control implementation in Tangro Business Workflow prior to 1.18.1 allows an malicious user to download documents (PDF) by providing a valid document ID and token. No further authentication is required.
Tangro Business Workflow
8.8
CVSSv3
CVE-2020-26174
tangro Business Workflow prior to 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser (client-side) and can be circumvented. This allows an malicious user t...
Tangro Business Workflow
6.5
CVSSv3
CVE-2020-26175
In tangro Business Workflow prior to 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users.
Tangro Business Workflow
4.3
CVSSv3
CVE-2020-26176
An issue exists in tangro Business Workflow prior to 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs....
Tangro Business Workflow
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
inject
CVE-2024-34001
CVE-2024-37018
LFI
CVE-2024-1275
CVE-2024-1086
CSRF
CVE-2024-31030
CVE-2024-24919
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »