Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

28 records in Robotic Process Automation For Cloud Pak · all components

TI-2023-23069 CVE-2023-43058 · GHSA-5qjv-68rj-pjqh

IBM Robotic Process Automation privilege escalation

Priority MEDIUM 43

IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00668 Published 2023-10-06 No fix listed
TI-2022-21351 CVE-2022-43574 · GHSA-p85m-rcvw-2rv6

Incorrect default permissions in IBM Robotic Process Automation

Priority MEDIUM 40

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00557 Published 2022-11-03 No fix listed CWE-276
TI-2023-24201 CVE-2023-45189 · GHSA-6wgw-qc2r-6vj3

IBM Robotic Process Automation information disclosure

Priority LOW 30

A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00632 Published 2023-11-03 No fix listed CWE-200
TI-2023-10958 CVE-2023-25680 · GHSA-8mmh-5rjw-w4rg

IBM Robotic Process Automation information disclosure

Priority LOW 30

IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00595 Published 2023-03-15 Fixed in 21.0.5 CWE-200
TI-2022-18242 CVE-2022-38710 · GHSA-vf32-gcpr-vgfq

IBM Robotic Process Automation information disclosure

Priority LOW 30

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00392 Published 2022-11-03 No fix listed CWE-497
TI-2024-33277 CVE-2024-49824 · GHSA-vcxw-vmr7-hmxx

IBM Robotic Process Automation security bypass

Priority LOW 29

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00334 Published 2025-01-18 No fix listed CWE-602
TI-2023-09317 CVE-2023-23476 · GHSA-rpj7-8p65-2w48

IBM Robotic Process Automation information disclosure

Priority LOW 29

IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0049 Published 2023-08-02 No fix listed CWE-863
TI-2022-23130 CVE-2022-46773 · GHSA-94jw-6h72-65h2

IBM Robotic Process Automation security bypass

Priority LOW 29

IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00503 Published 2023-03-15 Fixed in 21.0.7 CWE-287
TI-2022-18241 CVE-2022-38709 · GHSA-hm95-wj5x-jfqm

Cross-site scripting in IBM Robotic Process Automation

Priority LOW 28

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00538 Published 2022-10-06 No fix listed CWE-79
TI-2024-33278 CVE-2024-49825 · GHSA-9r58-7qgh-qjq2

IBM Robotic Process Automation session fixation

Priority LOW 27

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impers…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00228 Published 2025-04-14 No fix listed CWE-613
TI-2023-09015 CVE-2023-22863 · GHSA-2r26-hc5x-pcmw

IBM Robotic Process Automation information disclosure

Priority LOW 26

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00365 Published 2023-01-18 Fixed in 21.0.2 CWE-319
TI-2023-21194 CVE-2023-40370 · GHSA-gfrf-r6q5-j44j

IBM Robotic Process Automation information disclosure

Priority LOW 25

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00479 Published 2023-08-22 No fix listed
TI-2023-17968 CVE-2023-35900 · GHSA-c5rc-w46c-83hh

IBM Robotic Process Automation information disclosure

Priority LOW 25

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operati…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00509 Published 2023-07-19 No fix listed CWE-200
TI-2022-21350 CVE-2022-43573 · GHSA-gf2w-gwrg-m3gv

IBM Robotic Process Automation information disclosure

Priority LOW 25

IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00504 Published 2023-01-05 Fixed in 21.0.6 CWE-200
TI-2022-06780 CVE-2022-22502 · GHSA-9c9w-92jg-xmmq

Cross-site scripting in IBM Robotic Process Automation

Priority LOW 25

IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00507 Published 2022-06-24 No fix listed CWE-79
TI-2024-34383 CVE-2024-51457 · GHSA-885f-f3j2-3j6h

IBM Robotic Process Automation for Cloud Pak cross-site scripting

Priority LOW 24

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00212 Published 2025-01-22 No fix listed CWE-79
TI-2023-17969 CVE-2023-35901 · GHSA-c5rv-3w8m-4v6h

IBM Robotic Process Automation security bypass

Priority LOW 24

IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00458 Published 2023-07-16 No fix listed CWE-287
TI-2023-20073 CVE-2023-38732 · GHSA-3f43-hwc9-36qv

IBM Robotic Process Automation information disclosure

Priority LOW 21

IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00527 Published 2023-08-22 No fix listed CWE-532
Load more
Open these records in search →