CVE-2016-5398

Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes.

• CWE-79

• http://rhn.redhat.com/errata/RHSA-2016-1968.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1969.htmlVendor Advisory
• http://www.securityfocus.com/bid/93219Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1358523Issue Tracking, VDB Entry, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1968.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1969.htmlVendor Advisory
• http://www.securityfocus.com/bid/93219Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1358523Issue Tracking, VDB Entry, Vendor Advisory

Published

Oct 3, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5392The API server in Kubernetes, as used in Red Hat OpenShift E…
• CVE-2016-5393In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, …
• CVE-2016-5394In the XSS Protection API module before 1.0.12 in Apache Sli…6.1
• CVE-2016-5395Cross-site scripting (XSS) vulnerability in the create user …
• CVE-2016-5396Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPAC…
• CVE-2016-5397The Apache Thrift Go client library exposed the potential du…
• CVE-2016-5399The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5…7.8
• CVE-2016-5400Memory leak in the airspy_probe function in drivers/media/us…
• CVE-2016-5401Cross-site request forgery (CSRF) vulnerability in Red Hat J…
• CVE-2016-5402A code injection flaw was found in the way capacity and util…8.8
• CVE-2016-5403The virtqueue_pop function in hw/virtio/virtio.c in QEMU all…5.5
• CVE-2016-5404The cert_revoke command in FreeIPA does not check for the "r…