Ibm Robotic Process Automation vulnerabilities

CVE-2024-51456 [MEDIUM] CWE-780 CVE-2024-51456: IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a rem IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.

CVE-2024-51448 [MEDIUM] CWE-277 CVE-2024-51448: IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a loc IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service. A subsequent service or server restart will

CVE-2023-22863 [MEDIUM] CWE-319 CVE-2023-22863: IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.

CVE-2022-22503 [MEDIUM] CWE-1021 CVE-2022-22503: IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125.

CVE-2022-22319 [MEDIUM] CVE-2022-22319: IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366.

CVE-2023-35900 [MEDIUM] CWE-200 CVE-2023-35900: IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vu IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368.

CVE-2023-35901 [MEDIUM] CWE-287 CVE-2023-35901: IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to cl IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.

CVE-2022-38710 [MEDIUM] CWE-497 CVE-2022-38710: IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.

CVE-2022-38709 [MEDIUM] CWE-79 CVE-2022-38709: IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.

CVE-2022-43573 [MEDIUM] CWE-200 CVE-2022-43573: IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678.

CVE-2023-38718 [MEDIUM] CWE-200 CVE-2023-38718: IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from acc IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Force ID: 261606.

CVE-2023-40370 [MEDIUM] CVE-2023-40370: IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclos IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470.

CVE-2022-22502 [MEDIUM] CWE-79 CVE-2022-22502: IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnera IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227124.

CVE-2023-22594 [MEDIUM] CWE-79 CVE-2023-22594: IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scri IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244075.

CVE-2023-23468 [MEDIUM] CVE-2023-23468: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vu IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster. IBM X-Force ID: 244500.

CVE-2022-36774 [MEDIUM] CVE-2022-36774: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.

CVE-2022-22414 [MEDIUM] CVE-2022-22414: IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service confi IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026.

CVE-2022-22490 [MEDIUM] CWE-552 CVE-2022-22490: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain se IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.

CVE-2024-49825 [MEDIUM] CWE-613 CVE-2024-49825: IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVE-2023-38732 [MEDIUM] CWE-532 CVE-2023-38732: IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to vi IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289.