CVE-2015-1906

Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

• CWE-79

• http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772Patch, Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21700717Patch, Vendor Advisory
• http://www.securitytracker.com/id/1033002
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772Patch, Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21700717Patch, Vendor Advisory
• http://www.securitytracker.com/id/1033002

Published

Jul 21, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1900IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 throug…
• CVE-2015-1901The installer in IBM InfoSphere Information Server 8.5 throu…
• CVE-2015-1902Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 F…
• CVE-2015-1903Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 F…
• CVE-2015-1904IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.…
• CVE-2015-1905The REST API in IBM Business Process Manager (BPM) 7.5.x thr…
• CVE-2015-1907The Administration and Reporting Tool in IBM Rational Licens…
• CVE-2015-1908Cross-site scripting (XSS) vulnerability in IBM WebSphere Po…
• CVE-2015-1909The XML parser in the Reference Data Management component in…
• CVE-2015-1910Cross-site scripting (XSS) vulnerability in the Reference Da…
• CVE-2015-1911Cross-site scripting (XSS) vulnerability in Sterling Order M…
• CVE-2015-1913Rational Test Control Panel in IBM Rational Test Workbench a…