CVE-2014-3075

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR50092Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21679979Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93817
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50092Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21679979Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93817

Timeline

Published: Sep 4, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-30765.0IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unsp CVE-2014-30772.1IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log,CVE-2014-30792.1The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to CVE-2014-30804.3Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.2344 CVE-2014-30816.3prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to CVE-2014-30835.0IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict res CVE-2014-30844.9IBM Maximo Asset Management 6.1 through 6.5, 7.1 through 7.1.1.13, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5.0 through 7.5.0.3 an CVE-2014-30857.1systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to e CVE-2014-30867.5Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other produ CVE-2014-30874.0callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote auth CVE-2014-30885.5stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-dat CVE-2014-30894.9The RDS Java Client library in IBM Rational Directory Server (RDS) 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Ration