CVE-2022-47986

CVE-2022-47986 为什么 该漏洞已在野外被利用。 IceFire 利用此漏洞在目标系统上部署勒索软件，我希望帮助 SOC/蓝队识别受影响系统，帮助渗透测试/红队利用并报告漏洞。 描述 我提供了纯 Python 和 Ruby 脚本、Metasploit 和 Nmap 模块，用于利用 IBM Aspera Faspex 中因 YAML 反序列化导致的 RCE（远程代码执行）漏洞。 利用：RCE（远程代码执行） Python python3 CVE-2022-47986.py OR chmod u+x CVE-2022-47986.py ./CVE-2022-47986.py...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.18 Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process...

CVE-2026-14958

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14959

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

EUVD-2026-50055

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14996

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

CVE-2026-14996

IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...

CVE-2026-14996: Insufficient Session Expiration

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

CVE-2026-14959: Improper Neutralization of Special Elements used in an OS Command

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14958: Improper Neutralization of Special Elements used in an OS Command

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Aspera Orchestrator, IBM Aspera Virtual Catcher, IBM Aspera Faspex, IBM Aspera Shar

Question Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Aspera Orchestrator, IBM Aspera Virtual Catcher, IBM Aspera Faspex, IBM Aspera Shares "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM...

CVE-2025-36226

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-36226

CVE-2025-36226 affects IBM Aspera Faspex 5.0.0 through 5.0.14.3. A cross-site scripting flaw allows an authenticated user to inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. Root cause: improper handling of input in the Web UI. I...

CVE-2025-36227

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijackin...

CVE-2025-36227: Improper Neutralization of HTTP Headers for Scripting Syntax

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijackin...

CVE-2025-36226: Improper Neutralization of Input During Web Page Generation

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-24406

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

IBM Aspera Faspex 跨站脚本漏洞

IBM Aspera Faspex is a solution developed by IBM for rapid global personal-to-person file delivery and collaboration. Versions 5.5.0 to 5.0.14.3 of IBM Aspera Faspex contain a cross-site scripting vulnerability. This vulnerability stems from allowing authenticated users to embed arbitrary...