Security Bulletin: A vulnerability in Go may affect IBM Robotic Process Automation for Cloud Pack (CVE-2023-24532).

Summary Go is used by IBM Robotic Process Automation for Cloud Pak as part of the operator framework. CVE-2023-24532. Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified error with return an incorrect result in the ScalarMult and ScalarBaseMult methods of the P256 Curve in Gola...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. OpenSSL is used by IBM Robotic Process Automation as part of the API Server CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286. Golang Go is used by IBM Robotic Process Automation as part of...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to security misconfiguration which may result in elevated privileges (CVE-2023-22593).

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges CVE-2023-22593. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2023-225...

Rockwell Automation FactoryTalk Services Platform Trust Management Issue Vulnerability

Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation that provides routine services for applications such as diagnostic information, health monitoring and real-time data access. A trust management issue vulnerability exists in the Rockwell...

Security Bulletin: A vulnerability in Pypa Setuptools may affect IBM Robotic Process Automation for Cloud Pak and result in a denial of service (CVE-2022-40897)

Summary Pypa Setuptools is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2022-40897 Vulnerability Details CVEID:CVE-2022-40897 DESCRIPTION: Pypa Setuptools is vulnerable to a denial of service, caused by improper input validation. By sending request with a...

Security Bulletin: A vulnerability in WebSphere Application Server Liberty may affect IBM Robotic Process Automation and result in a denial of service (CVE-2023-24998).

Summary IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation as part of UMS and container services. CVE-2023-24998 Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit...

Security Bulletin: A vulnerability in Kubernetes kube-apiserver may affect IBM Robotic Process Automation for Cloud Pak and result in a bypass of security restrictions (CVE-2021-25735).

Summary Kubernetes kube-apiserver is used by IBM Robotic Process Automation for Cloud Pak as part of it's base container images. CVE-2021-25735 Vulnerability Details CVEID:CVE-2021-25735 DESCRIPTION: Kubernetes kube-apiserver could allow a remote authenticated attacker to bypass security...

Security Bulletin: IBM Cloud Pak for Network Automation 2.5.0 fixes multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.5.0 fixes multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-31047 DESCRIPTION: Django could allow a remote attacker to bypass security restrictions. By sending a specially-crafted request, an attacker...

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST controllers, related to insufficient validation of input data, allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST distributed controllers is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting XSS attacks remotely...

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST controllers, related to insufficient validation of input data, allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST distributed controllers is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting XSS attacks remotely...

PT-2023-3555 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.0 through 21.0.7.6 IBM Robotic Process Automation versions 23.0.0 through 23.0.6 Description: The issue is related to weaknesses in the authentication procedure of the software. Exploitation of thi...

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST controllers, related to insufficient validation of input data, allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST distributed controllers is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting XSS attacks remotely...

Rockwell Automation FactoryTalk Transaction Manager Denial of Service Vulnerability

Rockwell Automation FactoryTalk Transaction Manager is a control system for saving database data from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager's handling of port 400 access, which can be exploited by a remote attacker to submi...

Microsoft OLE Automation Remote code 安全漏洞

Microsoft OLE Automation Remote code is a software application from Microsoft Corporation USA. An automation software. A security vulnerability exists in Microsoft OLE Automation Remote code, which stems from allowing remote code execution and affects the following products and versions:Microsoft...

Use PCI DSS Checklist with Automation

Meet requirements and compliance levels without interrupting your workflow...

How Ticket Scalping Impacts Asia’s Live Entertainment Industry

Asia’s booming live entertainment industry has recently been plagued by a growing problem of ticket scalping. The term refers to the act of purchasing live event tickets in bulk by individuals, often through the use of automation aka bots, to later resell them at exorbitant prices. The issue isn’...

Siemens SICAM A8000 Devices CPCI85 Firmware Command Injection Vulnerability

The SICAM A8000 RTUs Remote Terminal Units series is a modular device family for remote control and automation applications in all areas of energy supply. A command injection vulnerability exists in the Siemens SICAM A8000 Devices CPCI85 Firmware, which can be exploited by an attacker to execute...

Siemens Totally Integrated Automation Portal Protection Mechanism Failure Vulnerability

The Totally Integrated Automation Portal is a PC software that offers the full range of Siemens digital automation services, from digital planning and integrated engineering to transparent operation. A protection mechanism failure vulnerability exists in Siemens Totally Integrated Automation...

CVE-2023-2778

A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or memory usage condition, causing...

CVE-2023-2639

The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This may allow a threat acto...