https://www.ibm.com/support/pages/apar/JR50795
JR50795: SECURITY APAR CVE-2015-0106 - REFLECTED CROSS-SITE SCRIPTING VULNERABILITY IN IBM PROCESS...
IBM Business Process Manager (BPM) is vulnerable to reflected cross-site scripting because user input is insufficient