CVE-2023-43058 IBM Robotic Process Automation privilege escalation

IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527...

CVE-2023-43058

The CVE-2023-43058 issue affects IBM Robotic Process Automation (RPA) 23.0.9 and IBM RPA for Cloud Pak 23.0.9, with a privilege-escalation flaw that can affect ownership of projects. Root cause is a privilege-elevation path in the RPA server, enabling non-privileged users to gain ownership rights...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak could disclose sensitive information from access to RPA scripts, workflows and related data (CVE-2023-38718)

Summary IBM Robotic Process Automation could disclose sensitive information from access to RPA scripts, workflows and related data. Vulnerability Details CVEID:CVE-2023-38718 DESCRIPTION: IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RP...

CVE-2023-38718 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Force ID: 261606...

CVE-2023-38718

IBM Robotic Process Automation (Cloud Pak) is affected by CVE-2023-38718, with information disclosure risk stemming from access to RPA scripts, workflows and related data. Affected products/versions include Cloud Pak 21.0.0–21.0.7.8 (also affecting 23.0.8). The cited vulnerability details indicat...

Information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293...

Cross site request forgery (csrf)

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

Privilege escalation

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

CVE-2023-40370 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-40370 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-40370

The CVE-2023-40370 entry affects IBM Robotic Process Automation runtime versions 21.0.0 through 21.0.7.1, where information disclosure of script content can occur if the remote REST request computer policy is enabled. The issue is described in the IBM bulletin and corroborated by Red Hat and NVD ...

CVE-2023-38733

CVE-2023-38733 affects IBM Robotic Process Automation server. An authenticated user could view sensitive information from installation logs, exposing data such as database connection strings. Affected versions include 21.0.0–21.0.7.3 and 23.0.0–23.0.3. Root cause relates to insufficient protectio...

CVE-2023-38733 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293...

CVE-2023-38734

IBM Robotic Process Automation is vulnerable to incorrect privilege assignment when importing users from an LDAP directory in versions 21.0.0–21.0.7.1 and 23.0.0–23.0.1. Root cause is an LDAP-import privilege issue; impact includes elevated access controls affecting confidentiality, integrity, an...

CVE-2023-38732

IBM Robotic Process Automation 21.0.0–21.0.7 server is affected by an information-disclosure vulnerability where an authenticated user can view sensitive data in application logs. The issue is described across multiple sources (IBM X-Force ID 262289; RH and CNVD entries) but the provided document...

Authorization

IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes. IBM X-Force ID: 245425...

CVE-2023-23476

CVE-2023-23476 affects IBM Robotic Process Automation versions 21.0.0–21.0.7.latest. The vulnerability stems from insufficient authorization validation on certain API routes, enabling unauthorized data access. Public details confirm impact as data disclosure and outline that upgraded versions 23....

CVE-2023-23476 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes. IBM X-Force ID: 245425...

CVE-2023-23476 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes. IBM X-Force ID: 245425...

CVE-2023-35900

CVE-2023-35900 affects IBM Robotic Process Automation for Cloud Pak and IBM Robotic Process Automation versions: 21.0.0–21.0.7.4 and 23.0.0–23.0.5. The root cause is disclosure of server version information, which may be used to determine OS-level vulnerabilities. Exploitation status is not descr...