CVE-2019-4336

CVE-2019-4336 affects IBM Robotic Process Automation with Automation Anywhere (v11). The vulnerability stems from an inadequate account lockout setting in the Forgot-Password/authentication flow, enabling a remote attacker to brute-force credentials. This is supported by multiple sources (NVD ent...

CVE-2019-4296

IBM Robotic Process Automation with Automation Anywhere (11.0) is affected by CVE-2019-4296. The issue allows a local attacker to read email contents from the client debug log file due to logging of sensitive data, constituting an information-disclosure vulnerability. Affected version: 11.0.0.0–1...

CVE-2019-4295

CVE-2019-4295 affects IBM Robotic Process Automation with Automation Anywhere version 11.0. The issue allows an attacker with specialized access to obtain highly sensitive information from the Credential Vault, representing a high-confidentiality disclosure (CVSSv3 base score 4.9). The IBM bullet...

PT-2019-17020 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue allows a local user to obtain e-mail contents from the client debug log file, potentially leading to information disclosure. Recommendations: For IBM...

PT-2019-17023 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue allows a local user to obtain highly sensitive information from log files when debugging is enabled. Recommendations: For IBM Robotic Process Automation...

PT-2019-17038 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations: For IBM...

PT-2019-17039 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue is related to missing authentication in Ignite nodes, which could allow an attacker to obtain sensitive information. Recommendations: For IBM Robotic...

PT-2019-17022 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue concerns the use of a high-privileged PostgreSQL account for database access in IBM Robotic Process Automation with Automation Anywhere. This could allo...

Security Bulletin: IBM Robotic Process Automation Credential Vault might leak secrets on the Client (CVE-2019-4295)

Summary IBM Robotic Process Automation Credential Vault might leak secrets on the Client Vulnerability Details CVEID: CVE-2019-4295 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow an attacker with specialized access to obtain highly sensitive from the credential...

Security Bulletin: IBM Robotic Process Automation uses a PostgreSQL admin account for accessing the application database (CVE-2019-4298)

Summary IBM Robotic Process Automation uses a PostgreSQL admin account for accessing the application database. Vulnerability Details CVEID: CVE-2019-4298 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere uses a high privileged PostgreSQL account for database access which could...

Security Bulletin: IBM Robotic Process Automation is vulnerable to LDAP Injection (CVE-2019-4297)

Summary IBM Robotic Process Automation is vulnerable to LDAP Injection. Vulnerability Details CVEID: CVE-2019-4297 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, a...

Security Bulletin: IBM Robotic Process Automation Client Security Token is written to the Client log file (CVE-2019-4299)

Summary IBM Robotic Process Automation Client Security Token is written to the Client log file Vulnerability Details CVEID: CVE-2019-4299 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a local user to obtain highly sensitive information from log files when...

Security Bulletin: IBM Robotic Process Automation prints E-Mail contents to the client debug log file (CVE-2019-4296)

Summary IBM Robotic Process Automation prints E-Mail contents to the client debug log file Vulnerability Details CVEID: CVE-2019-4296 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere information disclosure could allow a local user to obtain e-mail contents from the client debu...

Security Bulletin: IBM Robotic Process Automation Forgot-Password functionality is vulnerable to Brute-Force attacks (CVE-2019-4336)

Summary IBM Robotic Process Automation Forgot-Password functionality is vulnerable to Brute-Force attacks Vulnerability Details CVEID: CVE-2019-4336 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere uses an inadequate account lockout setting that could allow a remote attacker t...

CVE-2019-9759

An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approvecenter/list/inputform/workhandle.php runid parameter...

CVE-2019-9759

An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approvecenter/list/inputform/workhandle.php runid parameter...

Sql injection

An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approvecenter/list/inputform/workhandle.php runid parameter...

CVE-2019-9759

CVE-2019-9759 affects TONGDA Office Anywhere 10.18.190121. The vulnerability is a SQL Injection in the general/approve_center/list/input_form/work_handle.php’s run_id parameter, caused by improper input handling. Potential impact includes full confidentiality, integrity, and availability loss (pe...

CVE-2019-9759

An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approvecenter/list/inputform/workhandle.php runid parameter...

IBM Robotic Process Automation with Automation Anywhere Cross-Site Scripting Vulnerability

IBM Robotic Process Automation with Automation Anywhere is a suite of process automation solutions from IBM USA. A cross-site scripting vulnerability exists in IBM Robotic Process Automation with Automation Anywhere version 11.0, which can be exploited by remote attackers to inject arbitrary...