Aspera Faspex (Ibm) - vulnerabilities (CVEs)

49 CVEs, 0 in the last 30 days, 50 known versions, newest CVE from 2026-07-28. Vendor: Ibm.

CVEs of Aspera Faspex

CVE-2026-14958 - CVSS 9.1 (critical), 2026-07-28: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
CVE-2026-14959 - CVSS 9.1 (critical), 2026-07-28: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
CVE-2026-14996 - CVSS 8.2 (high), 2026-07-28: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
CVE-2025-36227 - CVSS 5.4 (medium), 2026-03-10: IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could…
CVE-2025-36226 - CVSS 5.4 (medium), 2026-03-10: IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary…
CVE-2025-36230 - CVSS 5.4 (medium), 2025-12-26: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be…
CVE-2025-36229 - CVSS 4.3 (medium), 2025-12-26: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVE-2025-36228 - CVSS 3.8 (low), 2025-12-26: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that…
CVE-2025-36225 - CVSS 4.3 (medium), 2025-10-09: IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of…
CVE-2025-36171 - CVSS 4.9 (medium), 2025-10-09: IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive…
CVE-2023-37401 - CVSS 5.3 (medium), 2025-10-09: IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.
CVE-2025-36040 - CVSS 6.5 (medium), 2025-07-31: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side…
CVE-2025-36039 - CVSS 6.5 (medium), 2025-07-31: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side…
CVE-2025-33137 - CVSS 8.8 (high), 2025-05-22: IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another…
CVE-2025-33136 - CVSS 8.8 (high), 2025-05-22: IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another…
CVE-2025-33138 - CVSS 6.1 (medium), 2025-05-22: IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be…
CVE-2025-3423 - CVSS 5.4 (medium), 2025-04-13: IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript…
CVE-2023-35907 - CVSS 9.8 (critical), 2025-01-29: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…
CVE-2023-37413 - CVSS 5.3 (medium), 2025-01-29: IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy.
CVE-2023-37412 - CVSS 4.9 (medium), 2025-01-29: IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls.
CVE-2023-37398 - CVSS 9.8 (critical), 2025-01-29: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…
CVE-2023-37395 - CVSS 3.3 (low), 2024-12-11: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data.
CVE-2024-45098 - CVSS 8.1 (high), 2024-09-05: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVE-2024-45097 - CVSS 7.1 (high), 2024-09-05: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVE-2024-45096 - CVSS 6.5 (medium), 2024-09-05: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.
CVE-2023-37411 - CVSS 5.4 (medium), 2024-05-28: IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2023-27279 - CVSS 6.5 (medium), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.
CVE-2022-40745 - CVSS 5.5 (medium), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452.
CVE-2023-37397 - CVSS 4.4 (medium), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM…
CVE-2023-22869 - CVSS 5.5 (medium), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 244119.
CVE-2023-37396 - CVSS 5.5 (medium), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID:…
CVE-2023-37400 - CVSS 7.8 (high), 2024-04-19: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677.
CVE-2022-22399 - CVSS 6.5 (medium), 2024-03-05: IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an…
CVE-2022-40744 - CVSS 5.4 (medium), 2024-02-02: IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2022-22401 - CVSS 7.5 (high), 2023-09-08: IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567.
CVE-2022-22409 - CVSS 5.3 (medium), 2023-09-08: IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM…
CVE-2022-22402 - CVSS 5.4 (medium), 2023-09-08: IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering…
CVE-2023-30995 - CVSS 7.5 (high), 2023-09-08: IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP…
CVE-2023-24965 - CVSS 5.8 (medium), 2023-09-08: IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713.
CVE-2022-22405 - CVSS 5.9 (medium), 2023-09-08: IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport…
CVE-2023-35906 - CVSS 7.5 (high), 2023-09-05: IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649.
CVE-2023-22870 - CVSS 5.9 (medium), 2023-09-05: IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force…
CVE-2023-27873 - CVSS 6.5 (medium), 2023-03-21: IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force…
CVE-2023-27871 - CVSS 7.5 (high), 2023-03-21: IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query.…
CVE-2023-27874 - CVSS 9.9 (critical), 2023-03-21: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit…
CVE-2023-27875 - CVSS 7.5 (high), 2023-03-16: IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.
CVE-2023-22868 - CVSS 5.4 (medium), 2023-02-17: IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering…
CVE-2022-47986 - CVSS 9.8 (critical), 2023-02-17: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization…
CVE-2022-22497 - CVSS 7.5 (high), 2022-05-24: IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.