CVE-2023-38367

The CVE-2023-38367 entry concerns IBM Cloud Pak Foundational Services Identity Provider (idP) API in IBM Cloud Pak for Automation across multiple releases (18.0.0 through 22.0.2 with various fixes). The issue allows CRUD operations with an invalid token, enabling an unauthenticated attacker to vi...

CVE-2024-49348

CVE-2024-49348 affects IBM Cloud Pak for Business Automation (versions 18.0.0 through 22.0.2). The issue is described as an incorrect privilege assignment that can restrict access to organizational data to valid contexts, with the root cause being that tasks of type comment can be reassigned via ...

CVE-2023-50959

CVE-2023-50959 affects IBM Cloud Pak for Business Automation across multiple releases (18.x through 23.x, including containers and traditional deployments). The vulnerability is an information-disclosure flaw where end users could query more documents than expected from a connected Enterprise Con...

CVE-2021-29859

CVE-2021-29859 affects IBM Cloud Pak for Business Automation, specifically IBM ICP4A - User Management System component in versions 21.0.3 (21.0.3-IF008), 21.0.2 (21.0.2-IF009), and 21.0.1 (21.0.1-IF007) and earlier. The issue arises from insufficient input/validation and logout handling, allowin...

CVE-2023-35899

CVE-2023-35899 affects IBM Cloud Pak for Automation versions 18.0.0 through 22.0.2. The issue is a CSV injection vulnerability caused by improper validation of CSV file contents, enabling a remote attacker to execute arbitrary commands on the system. Affected products/versions (per sources) inclu...

CVE-2024-37528

CVE-2024-37528 affects IBM Cloud Pak for Business Automation components (notably the Business Automation Studio/Center) with cross-site scripting that lets a privileged user embed arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. The issue ...

CVE-2024-31897

The CVE-2024-31897 entry relates to IBM Cloud Pak for Business Automation. All documented sources indicate an SSRF vulnerability in various CPBA versions (18.0.0 through 23.0.2, including 21.0.3, 23.0.2), where an authenticated attacker could cause the system to issue unauthorized requests, poten...

CVE-2023-35024

CVE-2023-35024 affects IBM Cloud Pak for Business Automation (versions 18.0.0–22.0.2). It is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. IBM’s remediation guidance spec...

CVE-2023-22860

IBM Cloud Pak for Business Automation is affected by CVE-2023-22860, a stored cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The issue affects multiple releases, including 18.0.x ...

CVE-2025-1838

CVE-2025-1838 affects IBM Cloud Pak for Business Automation (IBM Business Automation Workflow) 24.0.0 and 24.0.1 through 24.0.1 IF001. The vulnerability stems from an authenticated user bypassing client-side data validation in the authoring UI, which could lead to a denial of service. Red Hat/IBM...

CVE-2024-52364

CVE-2024-52364 affects IBM Cloud Pak for Business Automation versions 18.0.0–22.0.2. The description and IBM security bulletins confirm an authenticated user could embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session (Cross‑site Scriptin...

CVE-2023-32339

CVE-2023-32339: IBM Business Automation Workflow is vulnerable to cross-site scripting in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The bulletin and Red Hat/IBM sources list affected products and versions across I...

CVE-2024-52365

CVE-2024-52365 affects IBM Cloud Pak for Business Automation (versions 18.0.0 through 22.0.2). Description confirms a stored cross-site scripting vulnerability that could allow authenticated users to embed arbitrary JavaScript in the Web UI, potentially disclosing credentials within a trusted ses...

CVE-2024-41753

CVE-2024-41753 : IBM Cloud Pak for Business Automation exposures in 24.0.0 (up to IF004) and 24.0.1 (up to IF001) allow unauthenticated attackers to inject arbitrary JavaScript into the Web UI (reflected XSS), potentially altering UI behavior and disclosing credentials within a session. Affected ...

CVE-2023-23469

CVE-2023-23469 affects IBM ICP4A - Automation Decision Services versions 18.0.0 through 22.0.2. The issue allows web pages to be stored locally and readable by another user on the same system, representing an information disclosure impact. The connected sources consistently describe this as a loc...

CVE-2023-50947

IBM Business Automation Workflow (BBWA) is affected by CVE-2023-50947, a cross-site scripting vulnerability in the Web UI. The NVD/IBM sources indicate affected versions are 22.0.2, 23.0.1, and 23.0.2, with the issue allowing embedding of arbitrary JavaScript in the Web UI and potentially exposin...

CVE-2023-40691

CVE-2023-40691 affects IBM Cloud Pak for Business Automation (multiple versions across 18.x–22.x). The flaw exposes sensitive information from application configuration to developer and administrator users, enabling potential information disclosure without integrity or availability impact. Root c...

CVE-2025-36172

CVE-2025-36172 affects IBM Cloud Pak for Business Automation and IBM Business Automation Workflow. The IBM bulletin and related sources describe a stored cross-site scripting (XSS) vulnerability where an authenticated user can inject arbitrary JavaScript into the Web UI, potentially leading to cr...

CVE-2025-36023

Affected product: IBM Cloud Pak for Business Automation. Versions 24.0.0 through 24.0.0-IF005 and 24.0.1 through 24.0.1-IF002 are vulnerable. Root cause: indirect object reference via a user-controlled key allows an authenticated user to view sensitive user and system information. Impact: informa...

CVE-2025-36092

CVE-2025-36092 affects IBM Cloud Pak for Business Automation (25.0.0, 24.0.1, 24.0.0) and stems from improper validation of input length, allowing an authenticated user to cause a denial of service. IBM’s sources confirm the issue and provide targeted fixes: 25.0.0 should install security fix 25....

CVE-2025-36093

CVE-2025-36093 affects IBM Cloud Pak for Business Automation 25.0.0, 24.0.1, and 24.0.0. An improper access-control design could allow an attacker to access unauthorized content or perform unauthorized actions via man-in-the-middle techniques. This is supported by multiple connected sources ident...

CVE-2025-36094

CVE-2025-36094 affects IBM Cloud Pak for Business Automation. The issue is caused by improper validation of input length, allowing an authenticated user to cause a denial of service or corrupt existing data. Affected versions include 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 In...

CVE-2025-36091

CVE-2025-36091 affects IBM Cloud Pak for Business Automation Core components (25.0.0, 24.0.1, 24.0.0). Description and vendor advisories identify an ownership misassignment vulnerability (CWE-283: Unverified Ownership) that could allow an authenticated user to make dashboards inaccessible to legi...

CVE-2025-36436

CVE-2025-36436 affects IBM Cloud Pak for Business Automation (CPBA). The vulnerability is a stored cross-site scripting (XSS) flaw in the Web UI that can be triggered by an authenticated user, potentially allowing arbitrary JavaScript execution and credential disclosure within a trusted session. ...