Default credentials

IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X-Force ID: 151707...

CVE-2018-1876

IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X-Force ID: 151707...

CVE-2018-1878

CVE-2018-1878 affects IBM Robotic Process Automation with Automation Anywhere (11.0). The root cause is an information disclosure in web requests that could reveal sensitive data to an attacker, enabling future attacks. Affected version: 11.0.0.1. Remediation: upgrade to IBM Robotic Process Autom...

CVE-2018-1876

CVE-2018-1876 affects IBM Robotic Process Automation with Automation Anywhere 11.0, where passwords may be written in plaintext to a Control Room log file after installation. Affected versions: 11.0 (fixed in 11.0.0.2, with remediation JR60077). The issue stems from logging behavior in the produc...

CVE-2018-1877

CVE-2018-1877 affects IBM Robotic Process Automation with Automation Anywhere (11.0). The vulnerability stems from storing highly sensitive information as unencrypted passwords, making them readable by a local user. Impact is information disclosure of credentials stored by the RPA component. Reme...

CVE-2018-1552

CVE-2018-1552 affects IBM Robotic Process Automation with Automation Anywhere, versions 10.0 and 11.0. The vulnerability stems from a missing restriction on the types of files that can be uploaded to the control room, enabling a remote attacker to upload a malicious file and trick a user into exe...

Security Bulletin: IBM Robotic Process Automation could disclose sensitive information in a web request (CVE-2018-1878)

Summary IBM Robotic Process Automation could disclose sensitive information in a web request that could aid in future attacks against the system Vulnerability Details CVEID: CVE-2018-1878 DESCRIPTION: IBM Robotic Process Automation could disclose sensitive information in a web request that could...

CVE-2018-1795

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Cross site scripting

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1812

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web...

CVE-2018-1795

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1812

CVE-2018-1812 affects IBM Robotic Process Automation with Automation Anywhere Enterprise (V10.0). The vulnerability is a persistent cross-site scripting flaw caused by missing escaping of a database field in the Control Room, allowing an attacker with database access to execute scripts in a victi...

Cross site request forgery (csrf)

IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622...

CVE-2018-1514

IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622...

CVE-2018-1514

IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622...

CVE-2018-1547

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

CVE-2018-1547

IBM Robotic Process Automation with Automation Anywhere 10.0 is affected by CVE-2018-1547 due to improper output encoding in CSV exports, enabling remote code execution when a user opens a CSV and confirms two security questions in Excel. The vulnerability arises from encoding issues in the CSV e...

CVE-2018-1242

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files th...

Cross site scripting

IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. I...

CVE-2017-1751

IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. I...