CVE-2022-22434

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are affected by CVE-2022-22434, where a user with physical access can modify an API request to create additional objects. The IBM security bulletin lists remediation: upgrade to 21.0.1.6 for 21.0.1 and 21.0.2.3 for 21.0.2; RPA as a S...

CVE-2022-22433

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are affected by an External Service Interaction vulnerability caused by improper validation of user-supplied input. A remote attacker could induce the RPA server to perform server-side DNS lookups or HTTP requests to arbitrary domain...

CVE-2022-22319

IBM Robotic Process Automation 21.0.1 contains an authorization issue: a registered user can delete a queue, disrupting scripts dependent on that queue. The root cause is lack of privilege restrictions on queue deletion. A fix is available: upgrade to IBM Robotic Process Automation 21.0.1.2 or hi...

CVE-2022-38710

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are vulnerable to information disclosure of sensitive version details, which could aid attackers in further compromising the system. Affected products/versions include IBM RPA < 21.0.3, IBM RPA as a Service < 21.0.3, and IBM RP...

CVE-2022-43573

CVE-2022-43573 affects IBM Robotic Process Automation (RPA) versions 20.12–21.0.6. The root cause is exposure of the name and email of the creator/modifier for platform‑level objects, causing an information disclosure with confidentiality impact described as low (CVSS base 5.3/3.1 in alternative ...

CVE-2022-22503

CVE-2022-22503 affects IBM Robotic Process Automation prior to 21.0.1. A remote attacker could hijack the victim’s clicking action by persuading them to visit a malicious site, potentially enabling further attacks. CVSS base score 6.1 (NETWORK, UI:R, S:C, C:L/I:L). Remediation: upgrade to IBM Rob...

CVE-2022-22490

CVE-2022-22490 affects IBM Robotic Process Automation (RPA) versions

CVE-2022-22502

IBM Robotic Process Automation is affected by a cross-site scripting vulnerability (CVE-2022-22502) in versions 21.0.1 and 21.0.2. The issue allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Remediation per IBM bulletin: u...

CVE-2023-25680

CVE-2023-25680 affects IBM Robotic Process Automation: versions 21.0.1–21.0.5 (and related Cloud Pak/Service lines) are vulnerable due to insufficient protection of credentials; Queue Provider credentials are not obfuscated when editing queue provider details, enabling potential information discl...

CVE-2023-35901

IBM Robotic Process Automation (RPA) is affected by CVE-2023-35901 due to a client-side validation bypass in specific builds. Affected versions include IBM RPA 21.0.0–21.0.7.6 and 23.0.0–23.0.6. The underlying issue allows invalid changes or values to be accepted in certain fields via the client-...

CVE-2023-22591

CVE-2023-22591 affects IBM Robotic Process Automation versions 21.0.1–21.0.7 and 23.0.0–23.0.1. Root cause: session tokens are not invalidated after a password reset, potentially enabling an attacker with physical access to gain access to the system. Exploitation status is not provided in the sup...

CVE-2022-36774

IBM Robotic Process Automation (IBM RPA) is affected by CVE-2022-36774 for versions

CVE-2023-35900

CVE-2023-35900 affects IBM Robotic Process Automation for Cloud Pak and IBM Robotic Process Automation versions: 21.0.0–21.0.7.4 and 23.0.0–23.0.5. The root cause is disclosure of server version information, which may be used to determine OS-level vulnerabilities. Exploitation status is not descr...

CVE-2022-46773

IBM Robotic Process Automation (IBM RPA) versions 21.0.0–21.0.7 and 23.0.0 are affected by a client-side validation bypass in credential pools, which may allow creation of invalid credential pools. The issue’s root cause is client-side validation bypass for credential pools; impact is potential m...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions are corrobo...

CVE-2023-22863

IBM Robotic Process Automation versions 20.12.0–21.0.2 default to HTTP for some commands when the URL prefix isn’t explicit, enabling potential information disclosure via man-in-the-middle attacks. Affected products include IBM Robotic Process Automation, IBM Robotic Process Automation for Cloud ...

CVE-2022-33953

CVE-2022-33953 affects IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2. The root issue is insufficiently protected access tokens, which could allow a user with physical access to obtain sensitive information. Affected products include IBM RPA as a Service, IBM RPA for Cloud Pak, a...