Ibm Robotic Process Automation With Automation Anywhere vulnerabilities

CVE-2020-4901 [MEDIUM] CVE-2020-4901: IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of service through username enumeration. IBM X-Force ID: 190992.

CVE-2019-4336 [CRITICAL] CWE-307 CVE-2019-4336: IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout settin IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.

CVE-2019-4298 [HIGH] CVE-2019-4298: IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764.

CVE-2019-4295 [MEDIUM] CVE-2019-4295: IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758.

CVE-2019-4337 [MEDIUM] CWE-306 CVE-2019-4337: IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensiti IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.

CVE-2019-4297 [MEDIUM] CWE-90 CVE-2019-4297: IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attack IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.

CVE-2019-4299 [MEDIUM] CWE-532 CVE-2019-4299: IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765.

CVE-2019-4296 [LOW] CWE-532 CVE-2019-4296: IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a loca IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.

CVE-2018-1908 [MEDIUM] CWE-79 CVE-2018-1908: IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. Th IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152671.

CVE-2018-2006 [MEDIUM] CWE-22 CVE-2018-2006: IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to upload arbitrary files to the system. IBM X-Force ID: 155008.

CVE-2018-1552 [HIGH] CWE-434 CVE-2018-1552: IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to ex IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code on the system, caused by a missing restriction in which file types can be uploaded to the control room. By uploading a malicious file and tricking a victim to run it, an attacker could exploit this vulnerability to execute arbitrary c

CVE-2018-1877 [HIGH] CWE-312 CVE-2018-1877: IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unencrypted passwords that would be available to a local user. IBM X-Force ID: 151713.

CVE-2018-1876 [MEDIUM] CWE-532 CVE-2018-1876: IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the pa IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X-Force ID: 151707.

CVE-2018-1878 [MEDIUM] CWE-200 CVE-2018-1878: IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a IBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information in a web request that could aid in future attacks against the system. IBM X-Force ID: 151714.

CVE-2018-1795 [MEDIUM] CWE-79 CVE-2018-1795: IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site sc IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149073.

CVE-2018-1812 [MEDIUM] CWE-79 CVE-2018-1812: IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cr IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web browser within the security context of the hosting Web site,

CVE-2018-1514 [HIGH] CWE-352 CVE-2018-1514: IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request for IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622.

CVE-2018-1547 [HIGH] CVE-2018-1547: IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execut IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run an

CVE-2017-1751 [MEDIUM] CWE-79 CVE-2017-1751: IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135546.