CVE-2024-51456

CVE-2024-51456 affects IBM Robotic Process Automation (Cloud Pak, and standard RPA) versions 21.0.0–21.0.7.19 and 23.0.0–23.0.19. Root cause involves RSA usage without OAEP (CWE-780). Impact: remote attacker could obtain sensitive data exposed through crypto-analytic conditions. Remediation: upgr...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation versions...

Security Bulletin: Multiple Security vulnerablilites affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak. RedHat UBI is used as base imaged for IBM Robotic Process Automation for Cloud Pak images. Python is included in some container base images for IBM Robotic Process Automation for Cloud Pak. This bulleti...

Security Bulletin: Multiple vulnerabilities in IBM MQ affect IBM Robotic Process Automation for Cloud Pak

Summary Multiple vulnerabilities in IBM MQ affect IBM Robotic Process Automation for Cloud Pak. IBM MQ is used as base imaged for IBM Robotic Process Automation for Cloud Pak messaging. This bulletin identifies the fixes required to address these vulnerabilites. Vulnerability Details...

Security Bulletin: A vulnerability in Python affects IBM Robotic Process Automation which may allow and attacker to launch addtional attacks on the system (IBM X-Force ID: 273241)

Summary A vulnerability in Python affects IBM Robotic Process Automation which may allow and attacker to launch addtional attacks on the system. This bulletin identifies the fix to address this vulnerability. Vulnerability Details IBM X-Force ID: 273241 DESCRIPTION: GitLab Runner could provide...

Security Bulletin: vulnerability in Apache Commons HttpClient affects IBM Workload Automation.

Summary IBM Workload Automation is affected by a vulnerability in Apache Commons HttpClient that can cause Authorization Bypass CVE-2012-5783 Vulnerability Details CVEID:CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service FPS merchant Java SDK and oth...

Security Bulletin:Due to use of WebSphere Application Server traditional, IBM Workload Automation is vulnerable to a server-side request forgery (SSRF) vulnerability

Summary WebSphere Application Server traditional is used by IBM Workload Automation CVE-2024-22329 Vulnerability Details CVEID:CVE-2024-22329 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side...

Security Bulletin: Due to use of IBM WebSphere Application Server, IBM Workload Automation is vulnerable to a server-side forgery attack,

Summary IBM WebSphere Application Server is used by IBM Workload Automation CVE-2024-22354 Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External...

Security Bulletin: Due to use of IBM WebSphere Application Server, IBM Workload Automation is vulnerable to a denial of service,

Summary IBM WebSphere Application Server is used by IBM Workload Automation CVE-2024-25026 Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service...

Security Bulletin: vulnerability in OpenSSL affects IBM Workload Automation.

Summary IBM Workload Automation has vulnerability in OpenSSL CVE-2024-4603 Vulnerability Details CVEID:CVE-2024-4603 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper input validation by the EVPPKEYparamcheck or EVPPKEYpubliccheck function. By parsing a specially craft...

Security Bulletin: vulnerability in libcURL affects IBM Workload Automation.

Summary IBM Workload Automation has vulnerability in libcURL CVE-2024-7264 Vulnerability Details CVEID:CVE-2024-7264 DESCRIPTION: cURL libcurl could allow a local attacker to obtain sensitive information, caused by an out-of-bounds read flaw in the the GTime2str function. By sending a specially...

CVE-2024-43654

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects all Iocharger AC EV charger models on a firmware version before 25010801. Likelihood: Moderate – The binary do...

CVE-2024-43653

CVE-2024-43653 affects Iocharger AC model chargers running firmware before 24120701. The issue is an authenticated command-injection flaw in the action that lets an attacker execute OS commands as root, giving full control over the charging station (files/services). Impact is described as critic...

CVE-2024-43659

CVE-2024-43659 affects Iocharger AC-model EV chargers running firmware prior to 25010801. The issue involves a file (redacted path) accessible after gaining firmware access, enabling retrieval of default credentials that are identical across all AC chargers. The vulnerability enables login with t...

CVE-2025-22215

The CVE-2025-22215 SSRF vulnerability affects VMware Aria Automation. A malicious actor with "Organization Member" access can abuse server-side requests to enumerate internal services on the host/network. The advisory (VMSA-2025-0001) notes a CVSSv3 base score of 4.3 (Moderate) and lists fixed ve...

CVE-2025-22215 VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...

CVE-2025-22215 VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...

VMware Aria Automation 代码问题漏洞

VMware Aria Automation is a modern workflow automation platform from VMware that simplifies and automates complex data center infrastructure tasks to improve scalability and agility. A code issue vulnerability exists in VMware Aria Automation. An attacker exploiting this vulnerability could...

ABB AC500 安全漏洞

ABB AC500 is a programmable logic controller PLC from ABB Switzerland. A security vulnerability exists in ABB AC500 V3 prior to version 3.8.0, which stems from a directory traversal vulnerability that could allow an authenticated attacker to inject arbitrary commands into a specially crafted file...

VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

Advisory ID: | VMSA-2025-0001 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 4.3 Synopsis: | VMware Aria Automation update addresses a server side request forgery vulnerability CVE-2025-22215 Issue date: | 2025-01-07 Updated on: | 2025-01-07 CVEs | CVE-2025-22215 1. Impacted Products VMwar...