CVE-2021-38966

CVE-2021-38966 affects IBM Cloud Pak for Business Automation / IBM Cloud Pak for Automation Web UI (21.0.2). The IBM Bulletins and the IBM X-Force entry indicate a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentiall...

CVE-2021-29775

CVE-2021-29775 affects IBM Cloud Pak for Automation and IBM Business Automation Workflow. Concrete details across connected sources show a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted se...

CVE-2021-20482

The CVE-2021-20482 issue affects IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002. It is an XML External Entity Injection (XXE) vulnerability in XML data processing caused by improper handling of external entities, allowing a remote attacker to potentially expose sensitive information or cons...

CVE-2020-4325

CVE-2020-4325 affects IBM Process Federation Server and IBM Automation Workstream Services in Cloud Pak for Automation. The root cause is improper shutdown of thread pools used to retrieve Global Teams information, causing JVM memory to be unrecoverable and leading to OutOfMemory errors when the ...

CVE-2021-20359

Summary (CVE-2021-20359) is linked to IBM Cloud Pak for Automation. Affects: IBM Cloud Pak for Automation 20.0.3 and 20.0.2-IF002, specifically the Business Automation Application Designer component. Description in sources states that the component stores potentially sensitive information in log ...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 – Business Automation Studio component is vulnerable to HTTP header injection due to improper HOST header validation. A remote attacker can craft requests to inject the HOST header, enabling attacks such as cross-site scripting, cache poisoning, or s...

CVE-2021-20358

CVE-2021-20358 affects IBM Cloud Pak for Automation 20.0.3 and 20.0.2-IF002, where potentially sensitive information is stored in clear text in API connection log files. An attacker with log-read permissions could obtain this data. The IBM bulletin confirms an information-disclosure risk in the l...