CVE-2022-22415

The IBM Security Bulletin (CVE-2022-22415) notes that IBM Robotic Process Automation Server versions before 21.0.1.3 permit regular users to view some admin pages in the Control Center, an information-disclosure risk. The issue affects IBM RPA Server (on-premises) and is mitigated by upgrading to...

Security Bulletin: IBM Robotic Process Automation may allow regular users to view some admin pages.

Summary IBM Robotic Process Automation Server prior to 21.0.1.3 may allow regular users to view some admin pages Vulnerability Details CVEID: CVE-2022-22415 DESCRIPTION: A vulnerability exists where an IBM Robotic Process Automation regular user is able to obtain view-only access to some admin...

CVE-2022-22415

A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center IBM X-Force ID: 223029...

Exploit for Incorrect Authorization in Polkit_Project Polkit

Exploit for CVE-2021-3560 Polkit - Local Privilege Escalatio...

CVE-2022-26669

ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data...

CVE-2022-26668

ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service...

REDCap 11.3.9 - Stored Cross Site Scripting Vulnerability

Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting Exploit Author: Kendrick Lam References: https://github.com/KCL04/XSS-PoCs/blob/main/CVE-2021-42136.js Vendor Homepage: https://projectredcap.org Software Link: https://projectredcap.org Version: Redcap before 11.4.0 Tested on: 11.2.5 CVE...

CVE-2022-22190

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the...

CVE-2022-22190 Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the...

Juniper Networks Paragon 访问控制错误漏洞

Juniper Networks Paragon is a software application from Juniper, USA. A real-time network topology view. An access control error vulnerability exists in Juniper Networks Paragon Active Assurance Control Center version 3.1.0, which stems from the presence of an incorrect access control...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-35578)

Summary A maliciously crafted TLS 1.3 ClientHello packet can trigger a NullPointerException and an SSLException instead ofbeing rejected gracefully. The fix ensures that the invalid data is rejected gracefully. Vulnerability Details CVEID: CVE-2021-35578 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: A vulnerability in Java SE related to the Libraries component affects IBM Control Center (CVE-2020-14782)

Summary A flaw in the CertPath implementation allows certificate fingerprint checks to be bypassed under certain circumstances. The fix ensures that certificate fingerprint checks cannot be bypassed in this way. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2020-2773)

Summary Two XML Digital Signature APIs implemented in the XMLDSigRI provider throw unexpected Exception types. An attacker could exploit this to inflict a DoS. The fix ensures that all Exceptions thrown from these APIs are wrapped in instances of javax.xml.crypto.MarshalException. Vulnerability...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2020-14781)

Summary Under certain circumstances, encrypted LDAP connections can be downgraded to unencrypted connections. The fix ensures that encrypted LDAP connections cannot be downgraded in this way. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related ...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-35550)

Summary A flaw in the JSSE component causes cipher suites to be offered in the wrong order, with some weaker cipher suites ahead of stronger cipher suites. The fix ensures that stronger cipher suites are offered before weaker cipher suites. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION:...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-2369)

Summary A flaw in the JAR validation implementation may, under certain limited circumstances, lead to a failure to detect signedJAR files that have been modified. The fix ensures that JARs that have been modified since they were signed are properly detected and treated asunsigned. Vulnerability...

Security Bulletin: Vulnerabilities in Java SE and Eclipse OpenJ9 affect IBM Control Center (CVE-2020-14803 & CVE-2020-27221)

Summary A buffer overflow flaw has been found in a widely used function in the OpenJ9 JVM, which is employed when writingcharacters to a file. We have not identified any specific exploits, but it is very likely that the flaw is exploitable to trigger a crash or run arbitrary code. The fix ensures...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-2161)

Summary A flaw in the java.lang.ProcessBuilder API on the Windows platform leads to mishandling of escaped quotes inargument strings in certain circumstances. This allows an attacker to manipulate the Process command line andpotentially run unexpected commands.The fix ensures that quotes are...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-35603)

Summary A number of operations in the JSSE component are implemented in a way that means they could be exploited by anattacker in a side-channel attack due to timing differences. The fix ensures that the operations complete in constant-time. Vulnerability Details CVEID: CVE-2021-35603 DESCRIPTION...

ALBA-2022:0363 gnome-control-center bug fix update

The gnome-control-center package contains configuration utilities for the GNOME desktop, which allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings. Bug...