Aspera Orchestrator (Ibm) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 10 known versions, newest CVE from 2026-03-10. Vendor: Ibm.
CVEs of Aspera Orchestrator
- CVE-2025-13213 - CVSS 5.4 (medium), 2026-03-10: IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could…
- CVE-2025-13219 - CVSS 7.5 (high), 2026-03-10: IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties…
- CVE-2025-13481 - CVSS 8.8 (high), 2025-12-11: IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to…
- CVE-2025-13214 - CVSS 8.8 (high), 2025-12-11: IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow…
- CVE-2025-13211 - CVSS 6.5 (medium), 2025-12-11: IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of…
- CVE-2025-13148 - CVSS 8.1 (high), 2025-12-11: IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that…
- CVE-2023-38001 - CVSS 6.5 (medium), 2024-07-30: IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
- CVE-2023-26289 - CVSS 5.4 (medium), 2024-07-30: IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker…
- CVE-2023-26288 - CVSS 5.5 (medium), 2024-07-30: IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the…
- CVE-2023-27283 - CVSS 5.3 (medium), 2024-05-04: IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.
- CVE-2023-37407 - CVSS 8.8 (high), 2024-05-03: IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.…
