Aspera Faspex 5
by IBM
CVEs (46)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-47986 | Cri | 0.93 | 9.8 | 1.00 | KEV | Feb 17, 2023 | IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary… | |
| CVE-2023-27874 | Cri | 0.64 | 9.9 | 0.01 | Mar 21, 2023 | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. | ||
| CVE-2023-37400 | Hig | 0.51 | 7.8 | 0.00 | Apr 19, 2024 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677. | ||
| CVE-2023-30995 | Hig | 0.49 | 7.5 | 0.01 | Sep 8, 2023 | IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. IBM X-Force ID: 254268. | ||
| CVE-2023-27871 | Hig | 0.49 | 7.5 | 0.01 | Mar 21, 2023 | IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613. | ||
| CVE-2023-27875 | Hig | 0.49 | 7.5 | 0.01 | Mar 16, 2023 | IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. | ||
| CVE-2022-22497 | Hig | 0.49 | 7.5 | 0.01 | May 24, 2022 | IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951. | ||
| CVE-2025-33137 | Hig | 0.46 | 7.1 | 0.00 | May 22, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security. | ||
| CVE-2025-33136 | Hig | 0.46 | 7.1 | 0.00 | May 22, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data. | ||
| CVE-2024-45098 | Med | 0.44 | 6.8 | 0.00 | Sep 5, 2024 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. | ||
| CVE-2025-36040 | Med | 0.42 | 6.5 | 0.00 | Jul 31, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. | ||
| CVE-2025-36039 | Med | 0.42 | 6.5 | 0.00 | Jul 31, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms, | ||
| CVE-2024-45096 | Med | 0.42 | 6.5 | 0.00 | Sep 5, 2024 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing. | ||
| CVE-2023-27279 | Med | 0.42 | 6.5 | 0.01 | Apr 19, 2024 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533. | ||
| CVE-2023-27873 | Med | 0.42 | 6.5 | 0.01 | Mar 21, 2023 | IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654. | ||
| CVE-2023-37398 | Med | 0.38 | 5.9 | 0.00 | Jan 29, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. | ||
| CVE-2023-35907 | Med | 0.38 | 5.9 | 0.00 | Jan 29, 2025 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. | ||
| CVE-2024-45097 | Med | 0.38 | 5.9 | 0.00 | Sep 5, 2024 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. | ||
| CVE-2022-22401 | Med | 0.38 | 5.9 | 0.01 | Sep 8, 2023 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567. | ||
| CVE-2023-24965 | Med | 0.38 | 5.8 | 0.00 | Sep 8, 2023 | IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713. |
- risk 0.93cvss 9.8epss 1.00
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary…
- risk 0.64cvss 9.9epss 0.01
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.
- risk 0.51cvss 7.8epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677.
- risk 0.49cvss 7.5epss 0.01
IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. IBM X-Force ID: 254268.
- risk 0.49cvss 7.5epss 0.01
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613.
- risk 0.49cvss 7.5epss 0.01
IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.
- risk 0.49cvss 7.5epss 0.01
IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.
- risk 0.46cvss 7.1epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
- risk 0.46cvss 7.1epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data.
- risk 0.44cvss 6.8epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
- risk 0.42cvss 6.5epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
- risk 0.42cvss 6.5epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms,
- risk 0.42cvss 6.5epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.
- risk 0.42cvss 6.5epss 0.01
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.
- risk 0.42cvss 6.5epss 0.01
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.
- risk 0.38cvss 5.9epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- risk 0.38cvss 5.9epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- risk 0.38cvss 5.9epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
- risk 0.38cvss 5.9epss 0.01
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567.
- risk 0.38cvss 5.8epss 0.00
IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713.
Page 1 of 3