VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

Advisory ID: | VMSA-2025-0001 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 4.3 Synopsis: | VMware Aria Automation update addresses a server side request forgery vulnerability CVE-2025-22215 Issue date: | 2025-01-07 Updated on: | 2025-01-07 CVEs | CVE-2025-22215 1. Impacted Products VMwar...

The vulnerability of the `caf encrypt` and `sd_acmd encrypt` commands in the command-line interface (CLI) of Broadcom CA Client Automation software allows a malicious individual to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the caf encrypt and sdacmd encrypt commands in the command-line interface CLI of Broadcom CA Client Automation software relates to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges and gain unauthorized access to...

The vulnerability of the Swagger interface of the IBM WebSphere Automation platform for automating the management and deployment of applications and services allows a perpetrator to execute arbitrary code.

The vulnerability of the Swagger interface of the IBM WebSphere Automation platform for application and service automation and deployment is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious...

IBM WebSphere Automation Command Injection Vulnerability

IBM WebSphere Automation is an automation management software from IBM for optimizing and managing data center resources. A security vulnerability exists in IBM WebSphere Automation version 1.7.5. A remote attacker could exploit the vulnerability to execute arbitrary code on the system...

CVE-2024-38691

CVE-2024-38691 affects the Metorik – Reports & Email Automation for WooCommerce WordPress plugin (

CVE-2024-38691: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through = 1.7.1...

CVE-2024-54181

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system...

CVE-2024-54181

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system...

CVE-2024-54181

IBM WebSphere Automation 1.7.5 is vulnerable to an OS Command Injection due to improper neutralization of inputs in the Swagger UI. A remote privileged user with Swagger UI access can execute arbitrary code on the system. IBM’s security bulletin confirms affected version 1.7.5 and recommends upgr...

CVE-2024-54181 IBM WebSphere Automation command injection

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system...

CVE-2024-54181 IBM WebSphere Automation command injection

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system...

IBM WebSphere Automation 操作系统命令注入漏洞

IBM WebSphere Automation is an automation management software from IBM for optimizing and managing data center resources. A security vulnerability exists in IBM WebSphere Automation version 1.7.5. A remote attacker could exploit the vulnerability to execute arbitrary code on the system...

CVE-2024-54181: Improper Neutralization of Special Elements used in an OS Command

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system...

PT-2024-9964 · Ibm · Ibm Websphere Automation

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation version 1.7.5 Description: The vulnerability in the IBM WebSphere Automation platform's Swagger interface is related to the failure to neutralize special elements used in operating system commands. This could allow a...

The vulnerability of PwnDoc’s asynchronous interface functions in audit tools for automation of report generation allows a perpetrator to trigger a service failure.

The vulnerability of the asynchronous interface function of the PwnDoc automation tool for generating report documents is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of Adobe InDesign’s computer layout automation tool, related to memory-walking attacks, allows attackers to bypass ASLR protection and disclose the protected information.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to memory-walking attacks. Exploiting this vulnerability can allow attackers to bypass ASLR protection and disclose the protected information...

The vulnerability of Adobe InDesign’s computer layout automation tool, related to pointer naming errors, allows attackers to trigger a service failure.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to pointer assignment errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-8950

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arne Informatics Piramit Automation allows Blind SQL Injection. This issue affects Piramit Automation: before 27.09.2024...

CVE-2024-8950

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arne Informatics Piramit Automation allows Blind SQL Injection. This issue affects Piramit Automation: before 27.09.2024...

CVE-2024-8950

CVE-2024-8950 concerns an SQL Injection in Arne Informatics’ Piramit Automation. The vulnerability stems from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection. Affected: Piramit Automation versions prior to 27.09.2024. Impact is described as high for confi...