Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Python is used by IBM Robotic Process Automation as part of the NLP command implementation and part of the base container image for Antivirus and OCR services. Vulnerability Details CVEID:CVE-2021-4189 DESCRIPTION: Python could allow a remote attacker to obtain sensitive information, caus...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Java is used by IBM Robotic Process Automation for Cloud Pak as part of the the container images for services. Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no...

IBM Robotic Process Automation Access Control Error Vulnerability (CNVD-2022-68277)

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. An Access Control Error vulnerability exists in IBM Robotic Process Automation...

IBM Robotic Process Automation Clickjacking Vulnerability

IBM Robotic Process Automation is a robotic process automation product from IBM U.S.A. A clickjacking vulnerability exists in IBM Robotic Process Automation, which can be exploited by remote attackers to submit special url requests that can be parsed by users to obtain sensitive information or...

CVE-2022-36774

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575...

CVE-2022-22503

IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

Security Bulletin: IBM Robotic Process Automation is vulnerable to cross site scripting due to jquery-ui (CVE-2022-31160)

Summary jquery-ui is used by IBM Robotic Process Automation as part of the RPA Dashboard. CVE-2022-31160 Vulnerability Details CVEID:CVE-2022-31160 DESCRIPTION: jQuery UI is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the check-box-radio widget. A...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Redis is used by IBM Robotic Processing Automation for Cloud Pak as part of in memory database processing. Vulnerability Details CVEID:CVE-2021-41099 DESCRIPTION: Redis is vulnerable to an heap-based buffer overflow, caused by improper bounds checking in the underlying string library. By...

Security Bulletin: IBM Robotic Process Automation allows weak passwords prior to 21.0.3 (CVE-2022-35280)

Summary Prior to version 21.0.3 IBM Robotic Process Automation allowed weak passwords that may make it easier for attackers to compromise accounts. As of release 21.0.3 IBM Robotic Process Automation enforces strong passwords. Vulnerability Details CVEID:CVE-2022-35280 DESCRIPTION: IBM Robotic...

Security Bulletin: IBM Robotic Process Automation may be vulnerable to denial of service due to microsoft.owin.security.cookies (CVE-2022-29117)

Summary microsoft.owin.security.cookies is used by IBM Robotic Process Automation as part of Miscrosoft ASP.NET. CVE-2022-29117 Vulnerability Details CVEID:CVE-2022-29117 DESCRIPTION: Microsoft ASP.NET and Visual Studio are vulnerable to a denial of service. By sending a specially-crafted request...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Java is used by IBM Robotic Process Automation for Cloud Pak as part of several container services that run Java applications. Vulnerability Details CVEID:CVE-2022-21496 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated...

CVE-2022-36774

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575...

CVE-2022-38709

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2022-41294

IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation due to Java (CVE-2022-21541, CVE-2022-21540)

Summary Java is used by IBM Robotic Process Automation as part of the RPA infrastructure to run UMS and license management services CVE-2022-21541, CVE-2022-21540. Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could all...

CVE-2022-39168

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422...

CVE-2022-39168

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422...

CVE-2022-39168

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422...

Security Bulletin: IBM Robotic Process Automation may be vulnerable to spoofing attacks due to System.Security.Cryptography.Xml (CVE-2022-34716))

Summary System.Security.Cryptography.Xml is used by IBM Robotic Process Automation as part of the .NET Framework CVE-2022-34716 Vulnerability Details CVEID:CVE-2022-34716 DESCRIPTION: Microsoft .NET could allow a remote attacker to conduct spoofing attacks, caused by improper XML signature...

Security Bulletin: IBM Robotic Process Automation may be vulnerable to denail of service due to Newtonsoft.Json (IBM X-Force ID: 234366)

Summary Newtonsoft.Json is used by IBM Robotic Process Automation as part of JSON processing for .NET. IBM X-Force ID: 234366 Vulnerability Details IBM X-Force ID: 234366 DESCRIPTION: Newtonsoft.Json is vulnerable to a denial of service, caused by improper handling of StackOverFlow exception SOE...