Security Bulletin: Vulnerability in GraphQL Java may affect IBM Robotic Process Automation and result in a denial of service (CVE-2022-37734)

Summary There is a vulnerability in the Java used by IBM Robotic Process Automation as part of it's infrastructure, license management and UMS which may result in a denial of service. CVE-2022-37734. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability...

Security Bulletin: Multiple security vulnerabilities in Java may affect IBM Robotic Process Automation (CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619, CVE-2022-3676)

Summary There are multiple security vulnerabilities in Java used by IBM Robotic Process Automation as part of it's infrastrcture, license management and UMS components. This bulletin identifies the security fixes to apply to address the vulnerabilities. Vulnerability Details CVEID:CVE-2022-21628...

Security Bulletin: A vulnerability in minimatch may affect IBM Robotic Process Automation and result in a denial of service (CVE-2022-3517)

Summary There is a vulnerability in minimatch used by IBM Robotic Process Automation as part of the React framework which may result in a denial of service. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2022-3517 DESCRIPTION:...

CVE-2023-22863

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22592

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

Design/Logic Flaw

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109...

CVE-2023-22863

IBM Robotic Process Automation versions 20.12.0–21.0.2 default to HTTP for some commands when the URL prefix isn’t explicit, enabling potential information disclosure via man-in-the-middle attacks. Affected products include IBM Robotic Process Automation, IBM Robotic Process Automation for Cloud ...

CVE-2023-22863 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109...

CVE-2023-22594 IBM Robotic Process Automation for Cloud Pak cross-site scripting

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22594 IBM Robotic Process Automation for Cloud Pak cross-site scripting

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22592 IBM Robotic Process Automation for Cloud Pak insufficient permission settings

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

CVE-2023-22592 IBM Robotic Process Automation for Cloud Pak insufficient permission settings

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

PT-2023-18737 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 20.12.0 through 21.0.2 Description: The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because some RPA commands default to HTTP when the prefix is not...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. IBM Robotic Process Automation has a security vulnerability that could be exploited by remote attackers to submit special requests that could obtain sensitive information...

IBM Robotic Process Automation 跨站脚本漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A cross-site scripting vulnerability in IBM Robotic Process Automation in Clou...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA.IBM Robotic Process Automation for IBM Cloud Pak has a security...

PT-2023-18575 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to privilege escalation.

Summary IBM Robotic Process Automation for Cloud Pak could allow a local user to perform unauthorized actions due to insufficient permission settings. Vulnerability Details CVEID:CVE-2023-22592 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak could allow a local user to perform...

Security Bulletin: IBM Robotic Process Automation is vulnerable to man in the middle attacks

Summary IBM Robotic Process Automation defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID:CVE-2023-22863 DESCRIPTION: IBM Robotic...