Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
463 results · page 8 of 10
Aug 7, 2020Missing Authentication for Critical Function in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to receive and answer calls CVE-2020-16167 · Other software · Robotemi · reported by MITRECritical 9.1
Missing Authentication for Critical Function in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to receive and answer calls intended for another temi user. Answering the call this way grants motor control of the temi in addition to audio/video via unspecified vectors.
- Product
- Launcher OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmcafee.comrobotemi.com
Aug 7, 2020Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access the REST API and MQTT broker used by thCVE-2020-16168 · Other software · Robotemi · reported by MITREMedium 6.5
Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access the REST API and MQTT broker used by the temi and send it custom data/requests via unspecified vectors.
- Product
- Temi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmcafee.comrobotemi.com
Jul 15, 2020No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a passwCVE-2020-10284 · Other software · uFactory · reported by cve@aliasrobotics.comCritical 9.1
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session.
- Product
- xArm5 Lite, xArm 6 and xArm 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordufactory.ccufactory.cc
Jun 24, 2020The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashCVE-2020-10280 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comHigh 7.5
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecCVE-2020-10279 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order.CVE-2020-10278 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comMedium 4.6
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) oCVE-2020-10277 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comMedium 6.4
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020The password for the safety PLC is the default and thus easy to find (in manuals, etc.).CVE-2020-10276 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface.CVE-2020-10275 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard CVE-2020-10274 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comHigh 7.1
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots.CVE-2020-10273 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comHigh 7.5
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property and data.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication.CVE-2020-10272 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless aCVE-2020-10271 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as appropriate. Currently, the ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws such as CVE-2020-10269, the computation graph can also be fetched and interacted from wireless networks. This allows a malicious operator to take control of the ROS logic and correspondingly, the complete robot given that MiR's operations are centered around the framework (ROS).
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcodCVE-2020-10270 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users (omitted) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. This flaw allows cyber attackers to take control of the robot remotely and make use of the default user interfaces MiR has created, lowering the complexity of attacks and making them available to entry-level attackers. More elaborated attacks can also be established by clearing authentication and sending network requests directly. We have confirmed this flaw in MiR100 and MiR200 but according to the vendor, it might also apply to MiR250, MiR500 and MiR1000.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (AccessCVE-2020-10269 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt.CVE-2020-10268 · Other software · KUKA Roboter GmbH · reported by cve@aliasrobotics.comMedium 6.1
Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes needs to be performed. Be noted that this only can be accomplished either by a Kuka technician or by Kuka issued calibration hardware that interfaces with the manipulator furthering the delay and increasing operational costs.
- Product
- KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2020Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual proCVE-2020-10267 · Other software · Universal Robots · reported by cve@aliasrobotics.comHigh 7.5
Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCaps). These files (*.urcaps) are stored under '/root/.urcaps' as plain zip files containing all the logic to add functionality to the UR3, UR5 and UR10 robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property.
- Product
- UR3, UR5 and UR10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2020UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots.CVE-2020-10266 · Other software · Universal Robots · reported by cve@aliasrobotics.comHigh 8.1
UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g. in the UR10), no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universal Robots. An attacker could exploit this flaw by crafting a custom component with the SDK, performing Person-In-The-Middle attacks (PITM) and shipping the maliciously-crafted component on demand.
- Product
- URx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2020Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service callCVE-2020-10265 · Other software · Universal Robots · reported by cve@aliasrobotics.comCritical 9.4
Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.
- Product
- Universal Robots Robot Controllers CB 2, CB3, e-series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduniversal-robots.comuniversal-robots.com
Apr 6, 2020CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 whiCVE-2020-10264 · Other software · Universal Robots A/S · reported by cve@aliasrobotics.comHigh 8.8
CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outputs. Additionally unautheticated reading of robot data is also possible
- Product
- Universal Robots Robot Controllers CB 3.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduniversal-robots.comuniversal-robots.com
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) componentCVE-2020-8012 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) CVE-2020-8011 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comHigh 7.5
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comtechdocs.broadcom.com
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) coCVE-2020-8010 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
Jan 27, 2020An issue was discovered in Neato Botvac Connected 2.2.0.CVE-2018-19441 · Other software · Neatorobotics · reported by MITREMedium 4.7
An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorization. If an attacker knows the serial number and is able to estimate the time of first provisioning of a robot, he is able to brute force the generated secret_key of the robot. This is because the entropy of the secret_key exclusively relies on these two values, due to not seeding the random generator and using several constant inputs for secret_key computation. Serial numbers are printed on the packaging and equal the MAC address of the robot.
- Product
- Botvac Connected Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/ConfiguCVE-2020-2092 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
- Product
- Jenkins Robot Framework Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020A flaw was found in the way Red Hat Quay stores robot account tokens in plain text.CVE-2019-10205 · Other software · RED HAT · reported by Red HatMedium 6.3
A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.
- Product
- quay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 6, 2019SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2CVE-2019-19625 · Other software · ROS · reported by MITREMedium 5.3
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
- Product
- Sros2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2019The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.CVE-2015-9480 · WordPress plugins & themes · reported by MITREHigh 7.5
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
- Affected
- 5 to 5
- What to do
- Affects 5 to 5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 20, 2019The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.CVE-2015-9400 · WordPress plugins & themes · reported by MITREHigh 8.8
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
- Product
- wordpress-meta-robots
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update wordpress-meta-robots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2019ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.CVE-2019-15786 · Other software · Robotis · reported by MITRECritical 9.8
ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.
- Product
- Dynamixel SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2019UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.CVE-2018-19855 · Other software · Uipath · reported by MITREMedium 5.5
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
- Product
- Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduipath.comwww2.deloitte.com
Jul 19, 2019A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code.CVE-2019-12821 · Other software · Jisiwei · reported by MITREMedium 4.8
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.
- Product
- I3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2019A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner.CVE-2019-12820 · Other software · Jisiwei · reported by MITREMedium 5.6
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner.
- Product
- I3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2019The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.CVE-2019-13585 · Other software · Fanucamerica · reported by MITRECritical 9.8
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.
- Product
- Robotics Virtual Robot Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 17, 2019The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.CVE-2019-13584 · Other software · Fanucamerica · reported by MITREMedium 5.3
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
- Product
- Robotics Virtual Robot Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodesCVE-2019-4337 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account CVE-2019-4336 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabCVE-2019-4299 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perfoCVE-2019-4298 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection.CVE-2019-4297 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log fCVE-2019-4296 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 1, 2019IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault.CVE-2019-4295 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
May 31, 2019There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI.CVE-2019-12502 · Other software · Mobotix · reported by MITREHigh 8.8
There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI.
- Product
- S14 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 31, 2019An issue was discovered in Hybrid Group Gobot before 1.13.0.CVE-2019-12496 · Other software · Hybridgroup · reported by MITREHigh 7.5
An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.
- Product
- Gobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2019In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges.CVE-2019-11875 · Other software · Blueprism · reported by MITREHigh 8.8
In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user account to connect to the Blue Prism server, but the roles associated to this account are not required to have any permissions. First of all, the application files are modified to grant full permissions on the client side. In a test environment (or his own instance of the software) an attacker is able to grant himself full privileges also on the server side. He can then, for instance, create a process with malicious behavior and export it to disk. With the modified client, it is possible to import the exported file as a release and overwrite any existing process in the database. Eventually, the bots execute the malicious process. The server does not check the user's permissions for the aforementioned actions, such that a modification of the client software enables this kind of attack. Possible scenarios may involve changing bank accounts or setting passwords.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Apr 25, 2019A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary CVE-2018-19442 · Other software · Neatorobotics · reported by MITRECritical 9.8
A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud URI on the nucleo.neatocloud.com web site (port 4443).
- Product
- Botvac Connected Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedia.ccc.deusenix.org
Apr 24, 2019Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cleCVE-2019-10239 · Other software · Robotronic · reported by MITREHigh 7.8
Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cleartext credentials of the stored account.
- Product
- Runasspc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.to.comblog.to.com
Mar 15, 2019An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token.CVE-2018-17882 · Other software · Cryptobots · reported by MITREHigh 7.5
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.
- Product
- Battletoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordetherscan.iogithub.com
Mar 14, 2019IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting.CVE-2018-1908 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152671.
- Product
- Robotic Process Automation with Automation Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Feb 23, 2019Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices.CVE-2018-20785 · Other software · Neatorobotics · reported by MITREHigh 7.4
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.
- Product
- Botvac D4 Connected Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedia.ccc.demedia.ccc.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.