CVE-2019-4296: Insertion of Sensitive Information into Log File

IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759...

CVE-2019-4295: Undefined Security Weakness

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758...

CVE-2019-4337: Missing Authentication for Critical Function

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

CVE-2019-4336: Improper Restriction of Excessive Authentication Attempts

IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411...

PT-2019-17038 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations: For IBM...

PT-2019-17022 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue concerns the use of a high-privileged PostgreSQL account for database access in IBM Robotic Process Automation with Automation Anywhere. This could allo...

Security Bulletin: IBM Robotic Process Automation is vulnerable to LDAP Injection (CVE-2019-4297)

Summary IBM Robotic Process Automation is vulnerable to LDAP Injection. Vulnerability Details CVEID: CVE-2019-4297 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, a...

Security Bulletin: IBM Robotic Process Automation uses a PostgreSQL admin account for accessing the application database (CVE-2019-4298)

Summary IBM Robotic Process Automation uses a PostgreSQL admin account for accessing the application database. Vulnerability Details CVEID: CVE-2019-4298 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere uses a high privileged PostgreSQL account for database access which could...

Security Bulletin: IBM Robotic Process Automation Credential Vault might leak secrets on the Client (CVE-2019-4295)

Summary IBM Robotic Process Automation Credential Vault might leak secrets on the Client Vulnerability Details CVEID: CVE-2019-4295 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow an attacker with specialized access to obtain highly sensitive from the credential...

Security Bulletin: IBM Robotic Process Automation Forgot-Password functionality is vulnerable to Brute-Force attacks (CVE-2019-4336)

Summary IBM Robotic Process Automation Forgot-Password functionality is vulnerable to Brute-Force attacks Vulnerability Details CVEID: CVE-2019-4336 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere uses an inadequate account lockout setting that could allow a remote attacker t...

Security Bulletin: IBM Robotic Process Automation Client Security Token is written to the Client log file (CVE-2019-4299)

Summary IBM Robotic Process Automation Client Security Token is written to the Client log file Vulnerability Details CVEID: CVE-2019-4299 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a local user to obtain highly sensitive information from log files when...

Security Bulletin: IBM Robotic Process Automation prints E-Mail contents to the client debug log file (CVE-2019-4296)

Summary IBM Robotic Process Automation prints E-Mail contents to the client debug log file Vulnerability Details CVEID: CVE-2019-4296 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere information disclosure could allow a local user to obtain e-mail contents from the client debu...

CVE-2019-11875

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user...

CVE-2019-11875: Incorrect Resource Transfer Between Spheres

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user...

PT-2019-12535

Name of the Vulnerable Software and Affected Versions Blue Prism Robotic Process Automation version 6.4.0.8445 Description A vulnerability in access control exists, allowing for privilege escalation. This issue can be exploited to abuse the application for fraud or unauthorized access to certain...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2019 - Includes Oracle Jan 2019 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in Jan 2019. Vulnerability...

IBM Robotic Process Automation with Automation Anywhere Cross-Site Scripting Vulnerability

IBM Robotic Process Automation with Automation Anywhere is a suite of process automation solutions from IBM USA. A cross-site scripting vulnerability exists in IBM Robotic Process Automation with Automation Anywhere version 11.0, which can be exploited by remote attackers to inject arbitrary...

CVE-2018-1908

IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2018-1908

IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

PT-2019-9727

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 11 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure withi...