CVE-2019-4336

CVE-2019-4336 affects IBM Robotic Process Automation with Automation Anywhere (v11). The vulnerability stems from an inadequate account lockout setting in the Forgot-Password/authentication flow, enabling a remote attacker to brute-force credentials. This is supported by multiple sources (NVD ent...

CVE-2019-4336

IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411...

CVE-2019-4295

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758...

CVE-2019-4296

IBM Robotic Process Automation with Automation Anywhere (11.0) is affected by CVE-2019-4296. The issue allows a local attacker to read email contents from the client debug log file due to logging of sensitive data, constituting an information-disclosure vulnerability. Affected version: 11.0.0.0–1...

CVE-2019-4297

IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761...

CVE-2019-4295

CVE-2019-4295 affects IBM Robotic Process Automation with Automation Anywhere version 11.0. The issue allows an attacker with specialized access to obtain highly sensitive information from the Credential Vault, representing a high-confidentiality disclosure (CVSSv3 base score 4.9). The IBM bullet...

Security Bulletin: IBM Robotic Process Automation Ignite Cluster Nodes are missing authentication (CVE-2019-4337)

Summary IBM Robotic Process Automation Ignite Cluster Nodes are missing authentication Vulnerability Details CVEID: CVE-2019-4337 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow an attacker to obtain sensitive information due to missing authentication in Ignite...

Code injection

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user...

CVE-2019-11875

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user...

CVE-2019-11875

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user...

CVE-2019-11875

CVE-2019-11875 concerns Blue Prism Robotic Process Automation (RPA) 6.4.0.8445. The issue, in AutomateAppCore.dll, is an access-control flaw that allows privilege escalation when a valid user connects to the server; the user’s roles aren’t required to have permissions. The attack path involves mo...

Blue Prism Robotic Process Automation (RPA) Privilege Escalation

------------------------------------------------------------------------ SySS Security Advisory: Blue Prism Robotic Process Automation RPA - Privilege Escalation ------------------------------------------------------------------------ Advisory ID: SYSS-2019-002 Product: Blue Prism Robotic Process...

CVE-2018-1908

CVE-2018-1908 affects IBM Robotic Process Automation with Automation Anywhere version 11.0, where a cross-site scripting (XSS) vulnerability in the Web UI could allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Documented imp...

CVE-2018-1908

IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2018-2006

CVE-2018-2006 affects IBM Robotic Process Automation with Automation Anywhere (AA) 11.0. It is a directory traversal vulnerability where a remote attacker can craft a URL with dot-dot sequences (../) to traverse the filesystem and upload arbitrary files. The CVSS evidence indicates network access...

Code injection

IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be available to a local user. IBM X-Force ID: 151713...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caused by a missing restriction in which file types can be uploaded to the control room. By uploading a malicious file and tricking a victim to run it, an attack...

CVE-2018-1877

IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be available to a local user. IBM X-Force ID: 151713...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future attacks against the system. IBM X-Force ID: 151714...