CVE-2020-4436

CVE-2020-4436 affects IBM Aspera applications. The issue is a buffer overflow after valid authentication that could allow an attacker with system knowledge to execute arbitrary code via a service. Impact is described as high (C/H/I/H/A/H) in IBM and NVD records. The IBM bulletin lists affected IB...

CVE-2020-4435

CVE-2020-4435 affects IBM Aspera applications. The issue is arbitrary memory corruption due to product configuration, enabling an attacker with system knowledge to potentially execute arbitrary code or cause a DoS via the http fallback service. In IBM’s security bulletin for Aspera products, affe...

CVE-2020-4435

Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service. IBM X-Force ID:...

CVE-2020-4434

Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service. IBM...

CVE-2020-4433

Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force I...

CVE-2020-4434

CVE-2020-4434 is documented in IBM Aspera advisories as a buffer overflow in certain IBM Aspera applications, exploitable with valid authentication and product configuration via the http fallback service. The IBM Security Bulletin lists affected products (e.g., IBM Aspera High-Speed Transfer Serv...

CVE-2020-4433

CVE-2020-4433 concerns IBM Aspera applications vulnerable to a stack-based buffer overflow caused by improper bounds checking. The vulnerability could allow a remote attacker with knowledge of the system to execute arbitrary code with root privileges or cause the server to crash. The IBM security...

CVE-2020-4432

CVE-2020-4432 affects IBM Aspera applications vulnerable to command injection after valid authentication via the SOAP API. Affected products include IBM Aspera High-Speed Transfer Server/Endpoint, Aspera Proxy Server, Transfer Cluster Manager, and related platforms per IBM advisory. The root issu...

CVE-2020-4432

Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810...

CVE-2020-4434: Buffer Copy without Checking Size of Input

Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service. IBM...

CVE-2020-4435: Out-of-bounds Write

Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service. IBM X-Force ID:...

PT-2020-18065

Name of the Vulnerable Software and Affected Versions IBM Aspera affected versions not specified Description The issue is caused by improper bounds checking, leading to a stack-based buffer overflow. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary cod...

CVE-2020-4432: Improper Neutralization of Special Elements used in a Command

Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810...

CVE-2020-4436: Buffer Copy without Checking Size of Input

Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902...

PT-2020-18068

Name of the Vulnerable Software and Affected Versions IBM Aspera affected versions not specified Description The issue concerns a buffer overflow that can occur after valid authentication, potentially allowing an attacker with detailed system knowledge to execute arbitrary code through a service...

PT-2020-18064

Name of the Vulnerable Software and Affected Versions IBM Aspera affected versions not specified Description The issue allows an attacker with intimate knowledge of the system to execute commands in a SOAP API after valid authentication. This is a command injection issue that could be exploited b...

PT-2020-18066

Name of the Vulnerable Software and Affected Versions IBM Aspera affected versions not specified Description The issue is related to a buffer overflow that can occur based on the product configuration and valid authentication. This could allow an attacker with intimate knowledge of the system to...

PT-2020-18067

Name of the Vulnerable Software and Affected Versions IBM Aspera affected versions not specified Description The issue allows an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service, due to arbitrary memory...

CVE-2020-4433: Improper Input Validation

Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force I...

Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary Aspera Faspex on Demand 3.9.6, Aspera Platform On Demand 3.9.6, Aspera Shares on Demand 3.9.6, Aspera Server on Demand 3.9.6, Aspera Application on Demand 3.9.6 have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL could allow ...