Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation

Summary Python, Apache Spark, Tensorflow and Traefik contain multiple vulnerabilities and are used by IBM Robotic Process Automation as part of Watson NLP CVE-2022-40898, CVE-2023-22946, CVE-2023-25658, CVE-2023-25659, CVE-2023-25660, CVE-2023-25661, CVE-2023-25662, CVE-2023-25663, CVE-2023-25664...

Security Bulletin: Multiple security vulnerabilities in Java affect IBM Robotic Process Automation

Summary Java is used by IBM Robotic Process Autoamtion as part of the ILMT, NLP and Containers CVE-2023-2597, CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968. Vulnerability Details CVEID:CVE-2023-21968 DESCRIPTION: An unspecified...

Security Bulletin: A vulnerability in MicrosoftAspNetCore.Identity affects IBM Robotic Process Automation and may result in allowing an attacker to bypass secrity restrictions (CVE-2023-33170).

Summary Microsoft.AspNetCore.Identity is used by IBM Robotic Process Automation as part of login functionality. CVE-2023-33170 Vulnerability Details CVEID:CVE-2023-33170 DESCRIPTION: Microsoft SharePoint Server could allow a remote attacker to bypass security restrictions. By winning a race...

IBM Robotic Process Automation Log Information Disclosure Vulnerability

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation that stems...

CVE-2023-40370

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-38734

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

CVE-2023-40370

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470...

CVE-2023-38734

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

CVE-2023-38733

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293...

CVE-2023-38733

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293...

CVE-2023-40370

The CVE-2023-40370 entry affects IBM Robotic Process Automation runtime versions 21.0.0 through 21.0.7.1, where information disclosure of script content can occur if the remote REST request computer policy is enabled. The issue is described in the IBM bulletin and corroborated by Red Hat and NVD ...

CVE-2023-38733 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293...

CVE-2023-38733

CVE-2023-38733 affects IBM Robotic Process Automation server. An authenticated user could view sensitive information from installation logs, exposing data such as database connection strings. Affected versions include 21.0.0–21.0.7.3 and 23.0.0–23.0.3. Root cause relates to insufficient protectio...

CVE-2023-38734 IBM Robotic Process Automation privilege escalation

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

CVE-2023-38734 IBM Robotic Process Automation privilege escalation

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

CVE-2023-38734

IBM Robotic Process Automation is vulnerable to incorrect privilege assignment when importing users from an LDAP directory in versions 21.0.0–21.0.7.1 and 23.0.0–23.0.1. Root cause is an LDAP-import privilege issue; impact includes elevated access controls affecting confidentiality, integrity, an...

CVE-2023-38732

IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289...

CVE-2023-38732

IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289...

Code injection

IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289...

CVE-2023-38732

IBM Robotic Process Automation 21.0.0–21.0.7 server is affected by an information-disclosure vulnerability where an authenticated user can view sensitive data in application logs. The issue is described across multiple sources (IBM X-Force ID 262289; RH and CNVD entries) but the provided document...