Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.7 Vulnerability Details CVEID:CVE-2023-0044 DESCRIPTION: Quarkus could allow a remote attacker to obtain sensitive information, caused by a flaw when the Form Authentication session cookie Path attribute is se...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.6.1 Vulnerability Details CVEID:CVE-2021-25220 DESCRIPTION: ISC BIND could allow a remote attacker to bypass security restrictions, caused by an error when using DNS forwarders. An attacker could exploit this...

Security Bulletin: Multiple Vulnerabilities in Apache Ivy affect IBM Cloud Pak System

Summary Vulnerabilities found in Apache Ivy affect IBM Cloud Pak SystemCVE-2022-46751, CVE-2022-2765,CVE-2022-37866. Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Red Hat is used by IBM Robotic Process Automation for Cloud Pak as part of base container images. CVE-2016-4074. getaddrinfo is used by IBM Robotic Process Automation for Cloud Pak as part of the ba...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak (CVE-2022-43844)

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerabili...

Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in sensitive information disclosure (CVE-2022-41740)

Summary There is a vulnerability in IBM Robotic Process Automation, Sensitive information may be disclosed if an attacker has physical access to system memory. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2022-41740 DESCRIPTIO...

Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in exposure of the name and email for the creator/modifier of platform level objects (CVE-2022-43573)

Summary There is a vulnerability in IBM Robotic Process Automation. Accessing specific platform level objects created in RPA may expose the creator or modifiers email address. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details...

Security Bulletin: Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana

Summary Watson Machine Learning Accelerator on Cloud Pak for Data had an internal dependency on Grafana. Grafana dependency is now removed. Grafana component is no longer used or shipped with Watson Machine Learning Accelerator on Cloud Pak for Data. This bulletin identifies the steps to take to...

Security Bulletin: IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps is vulnerable to information disclosure and weaker security (CVE-2022-43901, CVE-2022-43900)

Summary IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps could disclose sensitive information and contain weaker than expected security. This has been addressed. Vulnerability Details CVEID:CVE-2022-43901 DESCRIPTION: IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps could...

Security Bulletin: Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for November 2022

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF015 and 22.0.1-IF005. Vulnerability Details CVEID:CVE-2022-41735 DESCRIPTION: IBM Business Process Manager 21.0.1 throug...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to possible information disclosure. (CVE-2022-38385)

Summary IBM Cloud Pak for Security is vulnerable to possible information disclosure. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Securit...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to command injection (CVE-2022-38387)

Summary IBM Cloud Pak for Security is vulnerable to command injection. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security CP4S...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to cross-site scripting (XSS) (CVE-2022-36776)

Summary IBM Cloud Pak for Security is vulnerable to cross-site scripting XSS. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security CP4S...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform (CVE-2022-42442)

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. Vulnerability Details CVEID:CVE-2022-42442 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak is vulnerable to exposure of...

Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficient protection of credentials created in the control center.

Summary IBM Robotic Process Automation is vulnerable to insufficient protection of credentials created in the control center. Vulnerability Details CVEID:CVE-2022-41293 DESCRIPTION: IBM Robotic Process Automation is vulnerable to insufficient protection of credentials created in the control cente...

Security Bulletin: IBM Robotic Process automation is vulnerable to storing sensitive data in temporary memory (CVE-2022-41295)

Summary IBM Robotic Process Automation Client may be vulnerable to sensitive data in temporary managed memory. Vulnerability Details CVEID:CVE-2022-41295 DESCRIPTION: IBM Robotic Process Automation Client may be vulnerable to sensitive data in temporary managed memory. CVSS Base score: 4 CVSS...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to cross site scripting (CVE-2022-38709)

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to cross site scripting through DOM manipulation. Vulnerability Details CVEID:CVE-2022-38709 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: IBM Robotic Process Automation is vulnerable to proxy credential exposure in upgrade logs (CVE-2022-39168)

Summary IBM Robotic Process Automation Client is vulnerable to proxy credential exposure in upgrade logs. Vulnerability Details CVEID:CVE-2022-39168 DESCRIPTION: IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. CVSS Base score: 4.6 CVSS...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to use-after-free due to systemd ( CVE-2022-2526 )

Summary Systemd is used by IBM Cloud Pak for Data as part of the base OS image. CVE-2022-2526 Vulnerability Details CVEID:CVE-2022-2526 DESCRIPTION: systemd could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw due to the onstreamio function and...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for Watson AIOps version 4.1.1 Vulnerability Details CVEID:CVE-2021-40528 DESCRIPTION: GnuPG Libgcrypt could allow a remote attacker to bypass security restrictions, caused by a flaw in the ElGamal implementation. By sending a...