1318 matches found
CVE-2023-27873
Summary: CVE-2023-27873 affects IBM Aspera Faspex 4.4.2. An authenticated remote attacker could obtain sensitive credential information by sending specially crafted XML input, per multiple sources (IBM X-Force ID 249654; Red Hat bulletin; CNVD/CVE references). The initial records assign a CVSSv3....
CVE-2023-27873 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654...
CVE-2023-27874 IBM Aspera Faspex XML external entity injection
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...
CVE-2023-27874
CVE-2023-27874 affects IBM Aspera Faspex 4.4.2. The vulnerability is an XML External Entity (XXE) injection when processing XML data, enabling a remote authenticated attacker to execute arbitrary commands. IBM X-Force lists the impact as high to critical, with a base score up to 9.9 (CRITICAL in ...
CVE-2023-27874 IBM Aspera Faspex XML external entity injection
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...
CVE-2023-27871 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613...
CVE-2023-27871 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613...
CVE-2023-27871
CVE-2023-27871 affects IBM Aspera Faspex 4.4.2. A remote attacker could obtain sensitive credential information for an external user via a specially crafted SQL query, indicating an SQL injection in Faspex’s handling of external input. The related Red Hat/NCSC entries and IBM security bulletin co...
Security Bulletin: IBM Aspera Faspex 5.0.4 can be vulnerable to improperly unauthorized password changes
Summary IBM Aspera Faspex could allow an unauthenticated user to change another user's credentials. The unauthenticated user can get a token that then lets them change another user's password. This issue has been resolved. Vulnerability Details CVEID:CVE-2023-27875 DESCRIPTION: IBM Aspera Faspex...
IBM Aspera 安全漏洞
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera Faspex, which can be exploited by an attacker to obtain sensitive credential information using...
IBM Aspera SQL注入漏洞
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM Inc. An SQL injection vulnerability exists in IBM Aspera Faspex version 4.4.2. The vulnerability stems from the application's lack of validation of external...
PT-2023-21386 · Ibm · Ibm Aspera Faspex
Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue allows a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. Recommendations: For IBM Aspera Faspex version 4.4.2, update to a...
PT-2023-21387 · Ibm · Ibm Aspera Faspex
Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this to execute arbitrary commands. Recommendations: For...
PT-2023-21385 · Ibm · Ibm Aspera Faspex
Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue allows a remote attacker to obtain sensitive credential information for an external user using a specially crafted SQL query. Recommendations: For IBM Aspera Faspex version 4.4.2, update ...
IBM Aspera 代码问题漏洞
IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...
IBM Aspera Faspex Web Detection
Binary data ibmasperafaspexwebdetect.nbin...
IBM Aspera Access Control Error Vulnerability (CNVD-2023-20083)
IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 5.0.4 is vulnerable to an access control error, which stems from the existence of improper access control of the application. An authenticated...
IBM Aspera Faspex < 4.4.2 Patch Level 2 Multiple Vulnerabilities
According to its self-reported version, the instance of IBM Aspera Faspex running on the remote web server is prior to 4.4.2 Patch Level 2. It is, therefore, affected by multiple vulnerabilities, including: - IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execu...
Vulnerability fixed in IBM Aspera Faspex
IBM has fixed a vulnerability in Aspera Faspex. A authenticated malicious user can use the vulnerability to change the password of another user. IBM has released a new container image to fix the vulnerability fix in Aspera Faspex 5.0.4. For more information, see:...
