Ubuntu: Security Advisory (USN-5299-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak Vulnerability Details CVEID:CVE-2022-27782 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by an easy connection reuse flaw for TLS and SSH. ...

CVE-2022-22490

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342...

Default credentials

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634...

Design/Logic Flaw

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342...

CVE-2022-35280

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634...

CVE-2022-35280

CVE-2022-35280 – IBM Robotic Process Automation affected versions are IBM Robotic Process Automation for Cloud Pak and IBM Robotic Process Automation (prior to 21.0.3). The vulnerability arises from default password settings that do not require strong passwords, enabling easier account compromise...

CVE-2022-22490

CVE-2022-22490 affects IBM Robotic Process Automation (RPA) versions

CVE-2022-22490

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342...

Code injection

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978...

Information disclosure

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Force ID: 219391...

CVE-2022-34338

CVE-2022-34338 affects IBM Robotic Process Automation up to version 21.0.2 (and related variants) due to improper privilege management for storage provider types, which could disclose sensitive information. The IBM bulletin and NVD entries confirm affected versions are

CVE-2022-34338

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962...

CVE-2022-33169

IBM Robotic Process Automation (RPA) versions 21.0.0–21.0.2 are vulnerable to insufficiently protected credentials for users created via bulk upload. The IBM Security Bulletin (and associated CVE-2022-33169 records) confirm affected products and affected versions: IBM RPA < 21.0.3, IBM RPA for...

CVE-2022-30616

Summary: CVE-2022-30616 affects IBM Robotic Process Automation and IBM RPA for Cloud Pak/Service, with versions prior to 21.0.3 vulnerable. A privileged user could elevate privileges to platform administrator by manipulating APIs. Impact: high (privilege escalation) with CVSS base scores in the h...

CVE-2022-22505

CVE-2022-22505 affects IBM Robotic Process Automation prior to version 21.0.3 (i.e., 21.0.0–21.0.2). The IBM Security Bulletin documents that this vulnerability could expose IBM tenant credentials. The CVSS scores in public records show a base impact on confidentiality (C:H) with no availability/...

CVE-2022-22334

IBM Robotic Process Automation is affected by CVE-2022-22334 through versions: on-premises 21.0.0, 21.0.1, 21.0.2 prior to the fixes; and RPA as a Service across all. The vulnerability allows a user to access information from a tenant they should not access (information disclosure). Remediation p...

EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2200)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driv...

Security Bulletin: IBM Robotic Process Automation may be affected by multiple vulnerabilities in open source components (CVE-2019-0820, CVE-2020-15522, CVE-2021-43569)

Summary Multiple vulnerabilities in IBM Robotic Process Automation 21.0.1brBouncy Castle is used by IBM Robotic Process Automation as part of it's cryptograpy implementation. CVE-2020-15522.brStark Bank Elixir is used by IBM Robotic Process Automation as part of it's cryptograpy implementation...

Information disclosure

IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198...