CVE-2014-4802

The Saved Search Admin component in the Process Admin Console in IBM Business Process Manager (BPM) 8.0 through 8.5.5 does not properly restrict task and instance listings in result sets, which allows remote authenticated users to bypass authorization checks and obtain sensitive information by executing a saved search.

• CWE-264

• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21684771Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95304
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50984Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21684771Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95304

Published

Oct 7, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4788IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 …
• CVE-2014-4789Session fixation vulnerability in IBM Initiate Master Data S…
• CVE-2014-4790IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0…
• CVE-2014-4792IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 throu…
• CVE-2014-4793IBM WebSphere MQ 8.x before 8.0.0.1 does not properly enforc…
• CVE-2014-4801Cross-site scripting (XSS) vulnerability in IBM Rational Qua…
• CVE-2014-4803CRLF injection vulnerability in the Universal Access impleme…
• CVE-2014-4804Curam Universal Access in IBM Curam Social Program Managemen…
• CVE-2014-4805IBM DB2 10.5 before FP4 on Linux and AIX creates temporary f…
• CVE-2014-4806The installation process in IBM Security AppScan Enterprise …5.5
• CVE-2014-4807Sterling Order Management in IBM Sterling Selling and Fulfil…
• CVE-2014-4808Unspecified vulnerability in IBM WebSphere Portal 6.1.0 thro…