Cross site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...

CVE-2023-35024 IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...

CVE-2023-35024

CVE-2023-35024 affects IBM Cloud Pak for Business Automation (versions 18.0.0–22.0.2). It is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. IBM’s remediation guidance spec...

CVE-2023-35024 IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...

IBM Cloud Pak for Business Automation Cross-Site Scripting Vulnerability

IBM Cloud Pak for Business Automation is a modular set of integrated software components from International Business Machines IBM, built for any hybrid cloud, designed to automate work and accelerate business growth. A security vulnerability exists in IBM Cloud Pak for Business Automation that...

PT-2023-25099 · Ibm · Ibm Cloud Pak For Business Automation

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Business Automation versions 18.0.0 through 22.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

Security Bulletin: A vulnerability in go-restful affects IBM Robotic Process Automation for Cloud Pak resulting in a bypass of security restrictions (CVE-2022-1996).

Summary A vulnerability in go-restful affects IBM Robotic Process Automation for Cloud Pak resulting in a bypass of security restrictions. go-restful is used by IBM Robotic Process Automation for Cloud Pak as part of the operator framework. This bulletin identifies the security fixes to apply to...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2023-30447 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect...

Security Bulletin: Vulnerability in Golang Go affects IBM Cloud Pak System [CVE-2023-24538]

Summary Golang Go code execution vulnerability affects Cloud Pak System. Cloud Pak System has addressed this vulnerability CVE-2023-24538. In addition it includes CVE-2023-24537. Vulnerability Details CVEID:CVE-2023-24538 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrary...

Security Bulletin: IBM Cloud Pak for Network Automation 2.6.2 fixes multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6.2 fixes multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-20859 DESCRIPTION: VMware Tanzu Spring Vault could allow a local authenticated attacker to obtain sensitive information, caused by the inserti...

Security Bulletin: Vulnerability in AIX affect OS Image for AIX shipped with Cloud Pak System (CVE-2022-22444)

Summary Vulnerability in AIX affect OS Image for AIX shipped with Cloud Pak System. Cloud Pak System has addressed vulnerability. Vulnerability Details CVEID:CVE-2022-22444 DESCRIPTION: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user to exploit a vulnerability in the lpd daemon to...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2023

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF025 and 23.0.1-IF003. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18...

Security Bulletin: IBM Robotic Process Automation is vulnerable to privilege escalation that affects ownership of project (CVE-2023-43058).

Summary IBM Robotic Process Automation server is vulnerable to privilege escalation that affects ownership of projects CVE-2023-43058. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-43058 DESCRIPTION: IBM Robotic Process...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak could disclose sensitive information from access to RPA scripts, workflows and related data (CVE-2023-38718)

Summary IBM Robotic Process Automation could disclose sensitive information from access to RPA scripts, workflows and related data. Vulnerability Details CVEID:CVE-2023-38718 DESCRIPTION: IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RP...

Security Bulletin: Operations Dashboard is vulnerable to denial of service due to Netty

Summary Operations Dashboard is vulnerable to denial of service due to Netty CVE-2023-34462 with details below. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS...

Security Bulletin: Operations Dashboard is vulnerable to header injection due to Golang Go

Summary Operations Dashboard is vulnerable to header injection due to Go CVE-2023-29406 with details below. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP header injection, caused by improper contents validation of Host header by the HTTP/1 client. By...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Golang Go [CVE-2023-29403]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Golang Go, caused by a flaw when a binary is run with the setuid/setgid bits CVE-2023-29403. Golang Go is included as part of the operators used by our Speech Services. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Golang Go [CVE-2023-29404]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code ececution in Golang Go, caused by a flaw when running "go get" on a malicious module CVE-2023-29404. Golang Go is included as part of the operators used by our Speech Services. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Golang Go [CVE-2023-29402]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Golang Go, caused by the generation of unexpected code at build time when using cgo CVE-2023-29402. Golang Go is included as part of the operators used by our Speech Services. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a sensitive information exposure in Google Guava [CVE-2023-2976]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a sensitive information exposure in Google Guava, caused by a flaw with using Java's default temporary directory for file creation in FileBackedOutputStream CVE-2023-2976. Google Guava is a Java utilities...