Ibm Robotic Process Automation vulnerabilities

49 known vulnerabilities affecting ibm/robotic_process_automation.

Total CVEs
49
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH6MEDIUM38LOW1

Vulnerabilities

Page 2 of 3
CVE-2023-22591LOWCVSS 3.2≥ 21.0.1, < 21.0.7.1≥ 23.0.0, < 23.0.2+2 more2023-03-15
CVE-2023-22591 [LOW] CWE-613 CVE-2023-22591: IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user wi IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710.
cvelistv5nvd
CVE-2023-22863MEDIUMCVSS 5.9fixed in 21.0.3≥ 20.12.0, < 21.0.22023-01-18
CVE-2023-22863 [MEDIUM] CWE-319 CVE-2023-22863: IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
cvelistv5nvd
CVE-2023-22594MEDIUMCVSS 5.4fixed in 21.0.52023-01-18
CVE-2023-22594 [MEDIUM] CWE-79 CVE-2023-22594: IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scri IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244075.
nvd
CVE-2022-41740MEDIUMCVSS 4.6fixed in 21.0.7≥ 20.12, < 21.0.62023-01-05
CVE-2022-41740 [MEDIUM] CWE-312 CVE-2022-41740: IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053.
cvelistv5nvd
CVE-2022-43573MEDIUMCVSS 5.3fixed in 21.0.7≥ 20.12, < 21.0.62023-01-05
CVE-2022-43573 [LOW] CWE-200 CVE-2022-43573: IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678.
cvelistv5nvd
CVE-2022-43574HIGHCVSS 7.5fixed in 21.0.62022-11-03
CVE-2022-43574 [HIGH] CWE-276 CVE-2022-43574: "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrec "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."
nvd
CVE-2022-38710MEDIUMCVSS 5.3fixed in 21.0.3v21.0.1, 21.0.22022-11-03
CVE-2022-38710 [MEDIUM] CWE-497 CVE-2022-38710: IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.
cvelistv5nvd
CVE-2022-41294MEDIUMCVSS 6.5≥ 21.0.0, ≤ 21.0.4v21.0.0+4 more2022-10-06
CVE-2022-41294 [MEDIUM] CWE-346 CVE-2022-41294: IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross ori IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807.
cvelistv5nvd
CVE-2022-22503MEDIUMCVSS 6.1fixed in 21.0.1v21.0.02022-10-06
CVE-2022-22503 [MEDIUM] CWE-1021 CVE-2022-22503: IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125.
cvelistv5nvd
CVE-2022-38709MEDIUMCVSS 6.1v21.0.0v21.0.1+2 more2022-10-06
CVE-2022-38709 [MEDIUM] CWE-79 CVE-2022-38709: IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.
cvelistv5nvd
CVE-2022-36774MEDIUMCVSS 5.3≥ 21.0.0, < 21.0.3v21.0.0+2 more2022-10-06
CVE-2022-36774 [MEDIUM] CVE-2022-36774: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.
cvelistv5nvd
CVE-2022-39168HIGHCVSS 7.5v21.0.3v21.0.42022-09-29
CVE-2022-39168 [HIGH] CWE-522 CVE-2022-39168: IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
cvelistv5nvd
CVE-2022-35280CRITICALCVSS 9.8v21.0.0v21.0.1+1 more2022-08-10
CVE-2022-35280 [CRITICAL] CWE-521 CVE-2022-35280: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have st IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
cvelistv5nvd
CVE-2022-22490MEDIUMCVSS 4.9fixed in 21.0.3v21.0.0+2 more2022-08-10
CVE-2022-22490 [MEDIUM] CWE-552 CVE-2022-22490: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain se IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
cvelistv5nvd
CVE-2022-30616HIGHCVSS 7.2≥ 21.0.0, < 21.0.3v21.0.0+2 more2022-08-01
CVE-2022-30616 [HIGH] CVE-2022-30616: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate t IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978.
cvelistv5nvd
CVE-2022-22505HIGHCVSS 7.5≥ 21.0.0, < 21.0.3v21.0.0+2 more2022-08-01
CVE-2022-22505 [HIGH] CVE-2022-22505: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 227288.
cvelistv5nvd
CVE-2022-34338MEDIUMCVSS 6.5≥ 21.0.0, < 21.0.3v21.0.0+2 more2022-08-01
CVE-2022-34338 [MEDIUM] CWE-269 CVE-2022-34338: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due t IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.
cvelistv5nvd
CVE-2022-33169MEDIUMCVSS 6.5≥ 21.0.0, ≤ 21.0.3v21.0.0+2 more2022-08-01
CVE-2022-33169 [MEDIUM] CWE-522 CVE-2022-33169: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888.
cvelistv5nvd
CVE-2022-22334MEDIUMCVSS 4.3≥ 21.0.1, < 21.0.1.7≥ 21.0.2, < 21.0.2.5+3 more2022-08-01
CVE-2022-22334 [MEDIUM] CVE-2022-22334: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information f IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Force ID: 219391.
cvelistv5nvd
CVE-2022-22412MEDIUMCVSS 4.6≥ 21.0.0, < 21.0.3v21.0.0+2 more2022-07-26
CVE-2022-22412 [MEDIUM] CVE-2022-22412: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the loca IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM X-Force ID: 223019.
cvelistv5nvd
← Previous2 / 3Next →