CVE-2023-27871

CVE-2023-27871 affects IBM Aspera Faspex 4.4.2. A remote attacker could obtain sensitive credential information for an external user via a specially crafted SQL query, indicating an SQL injection in Faspex’s handling of external input. The related Red Hat/NCSC entries and IBM security bulletin co...

Security Bulletin: IBM Aspera Faspex 5.0.4 can be vulnerable to improperly unauthorized password changes

Summary IBM Aspera Faspex could allow an unauthenticated user to change another user's credentials. The unauthenticated user can get a token that then lets them change another user's password. This issue has been resolved. Vulnerability Details CVEID:CVE-2023-27875 DESCRIPTION: IBM Aspera Faspex...

IBM Aspera 安全漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera Faspex, which can be exploited by an attacker to obtain sensitive credential information using...

PT-2023-21386 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue allows a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. Recommendations: For IBM Aspera Faspex version 4.4.2, update to a...

PT-2023-21387 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this to execute arbitrary commands. Recommendations: For...

IBM Aspera SQL注入漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM Inc. An SQL injection vulnerability exists in IBM Aspera Faspex version 4.4.2. The vulnerability stems from the application's lack of validation of external...

IBM Aspera 代码问题漏洞

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...

PT-2023-21385 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue allows a remote attacker to obtain sensitive credential information for an external user using a specially crafted SQL query. Recommendations: For IBM Aspera Faspex version 4.4.2, update ...

IBM Aspera Faspex Web Detection

Binary data ibmasperafaspexwebdetect.nbin...

IBM Aspera Access Control Error Vulnerability (CNVD-2023-20083)

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 5.0.4 is vulnerable to an access control error, which stems from the existence of improper access control of the application. An authenticated...

IBM Aspera Faspex < 4.4.2 Patch Level 2 Multiple Vulnerabilities

According to its self-reported version, the instance of IBM Aspera Faspex running on the remote web server is prior to 4.4.2 Patch Level 2. It is, therefore, affected by multiple vulnerabilities, including: - IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execu...

Vulnerability fixed in IBM Aspera Faspex

IBM has fixed a vulnerability in Aspera Faspex. A authenticated malicious user can use the vulnerability to change the password of another user. IBM has released a new container image to fix the vulnerability fix in Aspera Faspex 5.0.4. For more information, see:...

CVE-2023-27875

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847...

CVE-2023-27875

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847...

Improper access control

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847...

CVE-2023-27875 IBM Aspera Faspex improper access controls

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847...

CVE-2023-27875

IBM Aspera Faspex 5.0.4 is affected by an improper access control vulnerability (CVE-2023-27875) where an unauthenticated user could change other users’ credentials. Affected product: IBM Aspera Faspex 5.0.4 (container image faspex_core). Root cause: access-control weaknesses allow credential cha...

CVE-2023-27875 IBM Aspera Faspex improper access controls

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847...

PT-2023-21388 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 5.0.4 Description: The issue is related to improper access controls, allowing an authenticated user to change other users' credentials. Recommendations: For IBM Aspera Faspex version 5.0.4, at the moment, there is no...

IBM Aspera 安全漏洞

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 5.0.4 is vulnerable to an access control error, which stems from the existence of improper access control of the application. An authenticated...