Security Bulletin: IBM Cloud Pak for Security (CP4S) is vulnerable to information disclosure (CVE-2021-39089)

Summary IBM Cloud Pak for Security CP4S could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section...

Security Bulletin: IBM Cloud Pak for Security (CP4S) is vulnerable to information disclosure (CVE-2021-39011)

Summary IBM Cloud Pak for Security CP4S stores potentially sensitive information in log files that could be read by a privileged user. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section below to...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22592

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

CVE-2023-22592

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

Design/Logic Flaw

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

Cross site scripting

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions are corrobo...

CVE-2023-22594 IBM Robotic Process Automation for Cloud Pak cross-site scripting

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2023-22592 IBM Robotic Process Automation for Cloud Pak insufficient permission settings

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073...

CVE-2023-22592

CVE-2023-22592 affects IBM Robotic Process Automation for Cloud Pak versions < 21.0.5, where local users could perform unauthorized actions due to insufficient permission settings (privilege escalation). Affected products/versions: IBM RPA for Cloud Pak

IBM Robotic Process Automation 跨站脚本漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A cross-site scripting vulnerability in IBM Robotic Process Automation in Clou...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA.IBM Robotic Process Automation for IBM Cloud Pak has a security...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to privilege escalation.

Summary IBM Robotic Process Automation for Cloud Pak could allow a local user to perform unauthorized actions due to insufficient permission settings. Vulnerability Details CVEID:CVE-2023-22592 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak could allow a local user to perform...

Security Bulletin: IBM Robotic Process Automation is vulnerable to man in the middle attacks

Summary IBM Robotic Process Automation defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID:CVE-2023-22863 DESCRIPTION: IBM Robotic...

Security Bulletin: Decision Optimization in IBM Cloud Pak for Data is vulnerable to webpack loader-utils vulnerability [CVE-2022-37601]

Summary Decision Optimization in IBM Cloud Pak for Data is vulnerable to webpack loader-utils vulnerability with details below. This vulnerability has been addressed. CVE-2022-37601 Vulnerability Details CVEID:CVE-2022-37601 DESCRIPTION: webpack loader-utils could allow a remote attacker to execu...

Security Bulletin: A vulnerability in PostgreSQL JDBC Driver (PgJDBC) affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-21724)

Summary A vulnerability in PostgreSQL JDBC Driver PgJDBC affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2022-21724. Please see the details below on how to remediate this issue. Vulnerability Details CVEID:CVE-2022-21724 DESCRIPTION: PostgreSQL JDBC Driver PgJDBC could...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library ( CVE-2020-10029)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library, caused by a stack-based overflow during range reduction CVE-2020-10029. GNU C Library is used as part of the base image included in our service components. Please read th...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18311).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow, caused by an integer overflow in the Perlmysetenv function of Perl CVE-2018-18311. Perl is included in some of the operators used in IBM Watson Speech. Please read the details fo...