Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Python is used by IBM Robotic Process Automation as part of the Watson NLP functionality CVE-2015-20107. GNOME libxml2 is used by IBM Robotic Process Automation as part of container base images,...

CVE-2023-22863

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109...

Design/Logic Flaw

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

Cross site scripting

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22863

IBM Robotic Process Automation versions 20.12.0–21.0.2 default to HTTP for some commands when the URL prefix isn’t explicit, enabling potential information disclosure via man-in-the-middle attacks. Affected products include IBM Robotic Process Automation, IBM Robotic Process Automation for Cloud ...

CVE-2023-22863 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions are corrobo...

CVE-2023-22592

CVE-2023-22592 affects IBM Robotic Process Automation for Cloud Pak versions < 21.0.5, where local users could perform unauthorized actions due to insufficient permission settings (privilege escalation). Affected products/versions: IBM RPA for Cloud Pak

CVE-2022-43573

IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678...

CVE-2022-43844

IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081...

CVE-2022-43844

IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081...

Information disclosure

IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053...

Code injection

IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678...

Improper access control

IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081...

CVE-2022-43573

CVE-2022-43573 affects IBM Robotic Process Automation (RPA) versions 20.12–21.0.6. The root cause is exposure of the name and email of the creator/modifier for platform‑level objects, causing an information disclosure with confidentiality impact described as low (CVSS base 5.3/3.1 in alternative ...

CVE-2022-41740

Summary: CVE-2022-41740 affects IBM Robotic Process Automation (versions 20.12–21.0.6). A physically proximate attacker could obtain highly sensitive information from system memory. The vulnerability has a CVSSv3.1 base score of 4.6 (Medium). Affected software: IBM Robotic Process Automation (non...

CVE-2022-43844 IBM Robotic Process Automation for Cloud Pak session fixation

IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081...

CVE-2022-43844

CVE-2022-43844 affects IBM Robotic Process Automation for Cloud Pak versions 20.12–21.0.3. The root cause is a broken access control that prevents correct redirection to the platform logout screen upon logout. Public sources in the connected documents confirm the vulnerability in this product/ver...

CVE-2020-35473

CVE-2020-35473 describes an information‑leakage vulnerability in Bluetooth Low Energy advertising scan responses (including extended scan responses) that can identify devices using Resolvable Private Addressing (RPA). Affected are Bluetooth Core Specifications 4.0–5.2 and extended scan responses ...

CVE-2020-35473: Observable Discrepancy

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing RPA by...