The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Information Disclosure
Aarch64Cryptolib
NVD
GitHub
CVSS 3.1
3.7
EPSS
0.4%
IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password. Rated low severity (CVSS 3.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
IBM
Robotic Process Automation
Robotic Process Automation As A Service
NVD
CVSS 3.1
3.2
EPSS
0.2%