VMware Aria Automation and VMware Cloud Foundation Security Vulnerabilities

VMware Cloud Foundation and VMware Aria Automation are both products of VMware, Inc. VMware Cloud Foundation is an all-in-one hybrid cloud platform. VMware Cloud Foundation is an all-in-one hybrid cloud platform that includes operations automation, infrastructure auto-configuration, and integrate...

CVE-2023-7206

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape...

CVE-2023-7206

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape...

Design/Logic Flaw

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape...

CVE-2023-7206

The CVE-2023-7206 issue affects Horner Automation Cscape, specifically versions 9.90 SP10 and earlier. It is a stack-based buffer overflow vulnerability in Cscape when a user opens a malicious CSP file, allowing local attackers to execute arbitrary code on affected installations. The root cause, ...

CVE-2023-7206 Horner Automation Cscape Stack-Based Buffer Overflow

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape...

CVE-2023-7206 Horner Automation Cscape Stack-Based Buffer Overflow

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape...

Security Bulletin: Multiple CVEs - Vulnerabilities in IBM Java Runtime affect IBM Integration Designer

Summary Vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs. Vulnerability Details CVEID:CVE-2023-22049 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to arbitrary code execution due to Babel.

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to arbitrary code execution due to Babel CVE-2023-45133. Vulnerability Details CVEID:CVE-2023-45133 DESCRIPTION: Babel could allow a local attacker to execute arbitrary code on the system, caused by a...

Security Bulletin: IBM Automation Decision Services December 2023 - Multiple CVEs addressed

Summary IBM Automation Decision Services is vulnerable to denial of service attacks in third party and open source used in the product for various functions. See full list below. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could...

Security Bulletin: Security vulnerability in apache commons-codec may affect IBM Business Automation Workflow Case and Case History event emitters

Summary IBM Business Automation Workflow is vulnerable to an information leagage vulnerability. Vulnerability Details IBM X-Force ID: 177835 DESCRIPTION: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker cou...

The vulnerability of the Base64Element class in industrial automation software, Inductive Automation Ignition, allows a perpetrator to execute arbitrary code.

The vulnerability of the Base64Element class in Inductive Automation Ignition software is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the ResponseParser method in Inductive Automation Ignition’s software for industrial automation allows a perpetrator to execute arbitrary code.

The vulnerability of the ResponseParser method in Inductive Automation Ignition software relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the ExtendedDocumentCodec class in the industrial automation software suite Inductive Automation Ignition allows a perpetrator to execute arbitrary code.

The vulnerability of the ExtendedDocumentCodec class in Inductive Automation Ignition software relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the RunQuery class in industrial automation software, Inductive Automation Ignition, allows a perpetrator to execute arbitrary code.

The vulnerability of Inductive Automation Ignition’s software for industrial automation lies in the shortcomings of its deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

VMSA-2024-0001:VMware Aria Automation (formerly vRealize Automation) updates address a Missing Access Control vulnerability

Advisory ID: VMSA-2024-0001 CVSSv3 Range: 9.9 Issue Date:2024-01-16 Updated On: 2024-01-16 Initial Advisory CVEs: CVE-2023-34063 Synopsis: VMware Aria Automation formerly vRealize Automation updates address a Missing Access Control vulnerability CVE-2023-34063 RSS Feed Download PDF Download Text...

Security Bulletin: A vulnerability in json-c may affect IBM Robotic Process Automation for Cloud Pak and result in arbitrary code execution (CVE-2020-12762).

Summary json-c is used by IBM Robotic Process Automation as part of base container images. CVE-2020-12762. Vulnerability Details CVEID:CVE-2020-12762 DESCRIPTION: json-c could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow and out-of-bounds write. B...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This co...

Security Bulletin: A vulnerability in NSS may affect IBM Robotic Process Automation for Cloud Pak and result in a remote attacker obtaining sensitive information (CVE-2023-4421).

Summary NSS is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2023-4421. Vulnerability Details CVEID:CVE-2023-4421 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, could allow a remote authenticated attacker to obtain sensitive...