Security Bulletin: Multiple security vulnerabilities in Java affect IBM Robotic Process Automation

Summary Java is used by IBM Robotic Process Autoamtion as part of the ILMT, NLP and Containers CVE-2023-2597, CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968. Vulnerability Details CVEID:CVE-2023-21968 DESCRIPTION: An unspecified...

Security Bulletin: A vulnerability in MicrosoftAspNetCore.Identity affects IBM Robotic Process Automation and may result in allowing an attacker to bypass secrity restrictions (CVE-2023-33170).

Summary Microsoft.AspNetCore.Identity is used by IBM Robotic Process Automation as part of login functionality. CVE-2023-33170 Vulnerability Details CVEID:CVE-2023-33170 DESCRIPTION: Microsoft SharePoint Server could allow a remote attacker to bypass security restrictions. By winning a race...

PTC Kepware KepServerEX (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : PTC Equipment : Kepware KepServerEX Vulnerabilities : Uncontrolled Search Path Element, Improper Input Validation, Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of...

OPC UA Server DoS

The vulnerability of the OPC UA Server software for integration systems and automation devices in industrial applications is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms - Java deserialization filters (JEP 290) ignored during IBM ORB deserialization - (CVE-2022-40609)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by v4.1.0.4 to v4.1.1.0 of IBM Tivoli System Automation for Multiplatforms. Object Request Broker ORB in IBM SDK, Java Technology Edition has been affected. Vulnerability Details Refer to the security bulletins...

Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of client certificates. When parsing the...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go with details below. CVE-2023-29400, CVE-2023-29402, CVE-2023-29404, CVE-2023-29403, CVE-2023-29405 The vulnerabilities...

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they'll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate "fixer" somewhere in the organization. Thi...

IBM Robotic Process Automation Log Information Disclosure Vulnerability

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation that stems...

PT-2023-28831

Name of the Vulnerable Software and Affected Versions KNX Protocol affected versions not specified Description Devices using KNX Connection Authorization that support Option 1 are susceptible to a lockout mechanism issue. An attacker with network access or physical access to the device can utiliz...

PT-2023-8252

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the ResponsePars...

PT-2023-8693

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition affected versions not specified Description The issue is related to the getParams method in Inductive Automation Ignition, which allows remote attackers to execute arbitrary code on affected installations. This is...

PT-2023-8267

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the ResponsePars...

Security Bulletin: A CVE-2023-21967 vulnerability in IBM Java Runtime affects IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow

Summary A vulnerability exists in IBM® Runtime Environment Java™ Versions 8, which is used by the desktop version of IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow. IBM Process Designer has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21967...

Rockwell Automation ThinManager ThinServer Path Traversal File Upload (CVE-2023-2917)

Binary data rockwellthinmanagerthinservercve-2023-2917.nbin...

MAL-2023-1571 Malicious code in gapps-automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2fc1e430c7dfe87a465530b1e2067f640fda560b96555750466520fb727d8f19 The OpenSSF Package Analysis project identified 'gapps-automation' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in gapps-automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2fc1e430c7dfe87a465530b1e2067f640fda560b96555750466520fb727d8f19 The OpenSSF Package Analysis project identified 'gapps-automation' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation Select Distributed I/O Communication Modules

1. EXECUTIVE SUMMARY ​CVSS v3 8.6 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Rockwell Automation ​Equipment: 1734-AENT/1734-AENTR Series C, 1734-AENT/1734-AENTR Series B, 1738-AENT/ 1738-AENTR Series B, 1794-AENTR Series A, 1732E-16CFGM12QCWR Series A, 1732E-12X4M12QCDR Serie...

Security Bulletin: AIX is affected by security restrictions bypass (CVE-2023-24329) due to Python

Summary A vulnerability in Python could allow a remote attacker to bypass security restrictions CVE-2023-24329. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2023-24329 DESCRIPTION: Python could allow a remote attacker to bypass security...

CVE-2023-38734

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...