IBM Aspera 日志信息泄露漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A log information disclosure vulnerability exists in IBM Aspera Faspex, which can be exploited by an attacker to obtain sensitive information...

PT-2024-11980 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.7 Description: The issue concerns the storage of potentially sensitive information in log files, which could be accessed by a local user. Recommendations: For IBM Aspera Faspex versions 5.0.0 throu...

PT-2024-12125 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.7 Description: The issue is related to missing API rate limiting, which could allow a user to cause a denial of service. Recommendations: For IBM Aspera Faspex versions 5.0.0 through 5.0.7, conside...

Security Bulletin: IBM Aspera Faspex is vulnerable to multiple encryption vulnerabilities.

Summary IBM Aspera Faspex 5.0.8 has addressed multiple encryption vulnerabilities CVE-2023-22869, CVE-2023-37396, CVE-2023-27279, CVE-2023-37395, CVE-2023-37397, CVE-2022-40745 Vulnerability Details CVEID:CVE-2023-22869 DESCRIPTION: IBM Aspera Faspex stores potentially sensitive information in lo...

Security Bulletin: IBM Aspera Faspex is vulnerable to privilege escalation for local users.

Summary IBM Aspera Faspex has addressed a vulnerability due to insecure credential storage CVE-2023-37400 Vulnerability Details CVEID:CVE-2023-37400 DESCRIPTION: IBM Aspera Faspex could allow a local user to escalate their privileges due to insecure credential storage. CVSS Base score: 8.4 CVSS...

CVE-2022-22399

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...

Cross site scripting

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...

CVE-2022-22399

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...

CVE-2022-22399 IBM Aspera Faspex HTTP header injection

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...

CVE-2022-22399 IBM Aspera Faspex HTTP header injection

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...

CVE-2022-22399

IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by an HTTP header injection flaw caused by improper validation of the HOST header. The vulnerability can enable cross‑site scripting, cache poisoning, or session hijacking against vulnerable installations. Affected products: IBM Aspera Faspex 5.0.0 a...

IBM Aspera 安全漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An input validation error vulnerability exists in IBM Aspera Faspex versions 5.0.0 and 5.0.1, which stems from incorrect input validation of the HOST header a...

CVE-2022-40744

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441...

CVE-2022-40744

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441...

Cross site scripting

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441...

CVE-2022-40744 IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441...

CVE-2022-40744 IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441...

CVE-2022-40744

IBM Aspera Faspex 5.x is affected by a stored cross-site scripting (XSS) vulnerability in the Web UI. The issue impacts Faspex 5.0.6 and earlier, arising from improper handling of input in the UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a tru...

IBM Aspera Faspex Cross-Site Scripting Vulnerability

IBM Aspera is a suite of fast file transfer and streaming solutions from International Business Machines IBM built on the IBM FASP protocol. A cross-site scripting vulnerability exists in IBM Aspera Faspex version 5.0.6, which stems from vulnerability to stored cross-site scripting attacks. An...

Security Bulletin: IBM Aspera Faspex 5.0.6 has addressed multiple vulnerabilities (CVE-2023-22870, CVE-2023-35906, CVE-2022-22405, CVE-2023-24965, CVE-2023-30995, CVE-2022-22409, CVE-2022-22401, CVE-2022-22402)

Summary This Security Bulletin addresses security vulnerabilities that have been remediated in IBM Aspera Faspex 5.0.6 Vulnerability Details CVEID:CVE-2023-22870 DESCRIPTION: IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in t...