323 matches found
CVE-2022-33953
CVE-2022-33953 affects IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2. The root issue is insufficiently protected access tokens, which could allow a user with physical access to obtain sensitive information. Affected products include IBM RPA as a Service, IBM RPA for Cloud Pak, a...
CVE-2022-33953
IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198...
CVE-2022-22502
IBM Robotic Process Automation is affected by a cross-site scripting vulnerability (CVE-2022-22502) in versions 21.0.1 and 21.0.2. The issue allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Remediation per IBM bulletin: u...
Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens (CVE-2022-33953))
Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens CVE-2022-33953 Vulnerability Details CVEID:CVE-2022-33953 DESCRIPTION: IBM Robotic Process Automation could allow a user with psychical access to the system to obtain sensitive...
Design/Logic Flaw
IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026...
CVE-2022-22414
CVE-2022-22414 affects IBM Robotic Process Automation 21.0.2, where a local attacker could obtain sensitive web service configuration credentials from system memory due to credentials being stored unencrypted. The public data confirms the vulnerable component and root cause; impact is restricted ...
CVE-2022-30607
IBM Robotic Process Automation versions 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 are affected by an information disclosure vulnerability where sensitive data can be exposed due to improper masking in the Control Center UI. The issue, tracked as CVE-2022-30607, allows cross-tenant disclosure o...
CVE-2022-30607
IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294...
Sql injection
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 223022...
CVE-2022-22413
Summary: CVE-2022-22413 affects IBM Robotic Process Automation versions 21.0.0, 21.0.1, and 21.0.2 and is described as a SQL injection vulnerability that could allow a remote attacker to view, add, modify, or delete data in the back-end database. The IBM Security Bulletin and related sources conf...
CVE-2022-22319
IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366...
Design/Logic Flaw
IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366...
CVE-2022-22319
IBM Robotic Process Automation 21.0.1 contains an authorization issue: a registered user can delete a queue, disrupting scripts dependent on that queue. The root cause is lack of privilege restrictions on queue deletion. A fix is available: upgrade to IBM Robotic Process Automation 21.0.1.2 or hi...
Input validation
IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrar...
Design/Logic Flaw
A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center IBM X-Force ID: 223029...
CVE-2022-22434
IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are affected by CVE-2022-22434, where a user with physical access can modify an API request to create additional objects. The IBM security bulletin lists remediation: upgrade to 21.0.1.6 for 21.0.1 and 21.0.2.3 for 21.0.2; RPA as a S...
CVE-2022-22415
The IBM Security Bulletin (CVE-2022-22415) notes that IBM Robotic Process Automation Server versions before 21.0.1.3 permit regular users to view some admin pages in the Control Center, an information-disclosure risk. The issue affects IBM RPA Server (on-premises) and is mitigated by upgrading to...
CVE-2022-29856
A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages...
