CVE-2015-0158

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR52137Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52322Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52355Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21696378Patch, Vendor Advisory
http://www.securitytracker.com/id/1031964
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52137Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52322Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52355Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21696378Patch, Vendor Advisory
http://www.securitytracker.com/id/1031964

Timeline

Published: Mar 24, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-01609.0IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to exec CVE-2015-01616.5SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows rem CVE-2015-01627.0IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.CVE-2015-01674.3Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary CVE-2015-01683.5Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1 CVE-2015-01694.0IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inje CVE-2015-01702.1IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive in CVE-2015-01715.5Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allo CVE-2015-01727.5IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently exe CVE-2015-01734.3The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does no CVE-2015-01744.0The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allo CVE-2015-01755.5IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote