CVE-2022-22414

CVE-2022-22414 affects IBM Robotic Process Automation 21.0.2, where a local attacker could obtain sensitive web service configuration credentials from system memory due to credentials being stored unencrypted. The public data confirms the vulnerable component and root cause; impact is restricted ...

CVE-2022-22433

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are affected by an External Service Interaction vulnerability caused by improper validation of user-supplied input. A remote attacker could induce the RPA server to perform server-side DNS lookups or HTTP requests to arbitrary domain...

CVE-2022-38710

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are vulnerable to information disclosure of sensitive version details, which could aid attackers in further compromising the system. Affected products/versions include IBM RPA < 21.0.3, IBM RPA as a Service < 21.0.3, and IBM RP...

CVE-2022-22503

CVE-2022-22503 affects IBM Robotic Process Automation prior to 21.0.1. A remote attacker could hijack the victim’s clicking action by persuading them to visit a malicious site, potentially enabling further attacks. CVSS base score 6.1 (NETWORK, UI:R, S:C, C:L/I:L). Remediation: upgrade to IBM Rob...

CVE-2022-43573

CVE-2022-43573 affects IBM Robotic Process Automation (RPA) versions 20.12–21.0.6. The root cause is exposure of the name and email of the creator/modifier for platform‑level objects, causing an information disclosure with confidentiality impact described as low (CVSS base 5.3/3.1 in alternative ...

CVE-2022-22490

CVE-2022-22490 affects IBM Robotic Process Automation (RPA) versions

CVE-2022-43574

CVE-2022-43574 affects IBM Robotic Process Automation (RPA) versions older than 21.0.6. The issue is an incorrect permission assignment that could allow unauthorized access to application configurations. The Red Hat IBM Security Bulletin confirms the vulnerability details, including the affected ...

CVE-2023-25680

CVE-2023-25680 affects IBM Robotic Process Automation: versions 21.0.1–21.0.5 (and related Cloud Pak/Service lines) are vulnerable due to insufficient protection of credentials; Queue Provider credentials are not obfuscated when editing queue provider details, enabling potential information discl...

CVE-2022-41740

Summary: CVE-2022-41740 affects IBM Robotic Process Automation (versions 20.12–21.0.6). A physically proximate attacker could obtain highly sensitive information from system memory. The vulnerability has a CVSSv3.1 base score of 4.6 (Medium). Affected software: IBM Robotic Process Automation (non...

CVE-2023-22594

IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions are corrobo...

CVE-2023-22863

IBM Robotic Process Automation versions 20.12.0–21.0.2 default to HTTP for some commands when the URL prefix isn’t explicit, enabling potential information disclosure via man-in-the-middle attacks. Affected products include IBM Robotic Process Automation, IBM Robotic Process Automation for Cloud ...

CVE-2022-33953

CVE-2022-33953 affects IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2. The root issue is insufficiently protected access tokens, which could allow a user with physical access to obtain sensitive information. Affected products include IBM RPA as a Service, IBM RPA for Cloud Pak, a...