IBM Robotic Process Automation 跨站脚本漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A cross-site scripting vulnerability in IBM Robotic Process Automation in Clou...

PT-2023-18737 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 20.12.0 through 21.0.2 Description: The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because some RPA commands default to HTTP when the prefix is not...

PT-2023-18575 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to privilege escalation.

Summary IBM Robotic Process Automation for Cloud Pak could allow a local user to perform unauthorized actions due to insufficient permission settings. Vulnerability Details CVEID:CVE-2023-22592 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak could allow a local user to perform...

Security Bulletin: IBM Robotic Process Automation is vulnerable to man in the middle attacks

Summary IBM Robotic Process Automation defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID:CVE-2023-22863 DESCRIPTION: IBM Robotic...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Apache Commons is used by IBM Robotic Process Automation as part of the Watson NLP functionality CVE-2022-42889. Connect2id Nimbus JOSE+JWT is used by IBM Robotic Process Automation as part of the...

CVE-2022-43573 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678...

CVE-2022-41740 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053...

CVE-2022-43844 IBM Robotic Process Automation for Cloud Pak session fixation

IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081...

Security Bulletin: A vulnerability in Java may affect IBM Robotic Process Automation (CVE-2021-2163)

Summary There is a vulnerability in Java used by IBM Robotic Process Automation as part of the RPA infrastructure to run UMS and license management services This bulletin identifies the security fixes to apply to address the vulnerabilities. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: ...

Security Bulletin: A vulnerability in Golang Go may affect IBM Robotic Process Automation for Cloud Pak and result in a denial of service (CVE-2022-27664)

Summary There is a vulnerability in Golang Go used by IBM Robotic Process Automation for Cloud Pak as part of the operator which may result in a denial of service. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2022-27664...

Security Bulletin: A vulnerability in IBM Java may affect IBM Robotic Process Automation and result in a denial of servce (CVE-2022-24839)

Summary There is a vulnerability in IBM Java used by IBM Robotic Process Automation as part of it's infrastructure, licence management and User Management Services which may result in a denial of service. This bulletin identifies the security fixes to apply to address this vulnerability...

Security Bulletin: A vulnerability in nginx may affect IBM Robotic Process Automation for Cloud Pak resulting in a denial of service (CVE-2022-41741, CVE-2022-41742)

Summary There is a vulnerability in nginx used by IBM Robotic Process Automation for Cloud Pak as part of the container ingress controller that may result in a denial of service. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details...

CVE-2022-38710

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292...

PT-2022-26976 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.1 through 21.0.5 Description: The issue is related to incorrect permission assignment, which could allow access to application configurations. Recommendations: For IBM Robotic Process Automation...

CVE-2022-42442 IBM Robotic Process Automation for Cloud Pak information disclosure

IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214...

CVE-2022-43574

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."...

Security Bulletin: IBM Robotic Process Automation may be vulnerable to HTTP Header Injections due to IBM WebSphere Application Server Liberty (CVE-2022-34165)

Summary IBM WebSphere Applicaiton Server Liberty is used by IBM Robotic Process Automation as part of OCR, Antivirus, and User Management Services. CVE-2022-34165 Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak may be vulnerable to server-side forgery requests due to Kubernetes kube-apiserver (CVE-2022-3172)

Summary Kubernetes kube-apiserver is used by IBM Robotic Process Automation for Cloud Pak as part of base container images. CVE-2022-3172 Vulnerability Details CVEID:CVE-2022-3172 DESCRIPTION: Kubernetes kube-apiserver is vulnerable to server-side request forgery, caused by a flaw with allowing a...

Security Bulletin: IBM Robotic Process Automation is allows weak passwords priort to 21.0.3 (CVE-2022-35280)

Summary Prior to version 21.0.3 IBM Robotic Process Automation allowed weak passwords that may make it easier for attackers to compromise accounts. As of release 21.0.3 IBM Robotic Process Automation enforces strong passwords. Vulnerability Details CVEID:CVE-2022-35280 DESCRIPTION: IBM Robotic...