Security Bulletin: IBM Aspera Shares is affected by the following NGINX vulnerability (CVE-2019-13617)

Summary IBM Aspera Shares has addressed the following NGINX vulnerability Vulnerability Details CVEID: CVE-2019-13617 DESCRIPTION: njs, used in NGINX, is vulnerable to a denial of service, caused by a heap-based buffer over-read in nxtvsprintf in nxt/nxtsprintf.c during error handling. By...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2019-12208, CVE-2019-12207)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-12208 DESCRIPTION: NGINX njs is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the njsfunctionnativecall function in njs/njsfunction.c. By sending...

Security Bulletin: Aspera Web Applications (Faspex, Console, Orchestrator) are affected by OpenSSL Vulnerabilities (CVE-2019-1547, CVE-2019-1549, CVE-2019-1563)

Summary Aspera Web Applications Faspex, Console, Orchestrator have addressed the following OpenSSL Vulnerabilities. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However,...

Security Bulletin: Aspera Web Faspex application is affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary IBM Aspera Faspex has addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is mos...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Security Bulletin: Aspera Web Applications (Faspex, Console) are affected by Apache Vulnerabilities (CVE-2019-0196, CVE-2019-0197, CVE-2019-0215, CVE-2019-0217, CVE-2019-0220)

Summary Aspera Web Applications Faspex, Console have addressed the following Apache Vulnerabilities. Vulnerability Details CVEID: CVE-2019-0220 DESCRIPTION: A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive...

Security Bulletin: IBM Aspera WebApps (Shares, Faspex, Console, Orchestrator) and products are affected by OpenSSL Vulnerability (CVE-ID: CVE-2019-1543)

Summary IBM Aspera WebApps Shares, Faspex, Console, Orchestrator products have addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1543 DESCRIPTION: ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539...

Security Bulletin: Aspera Web Applications (Faspex, Console, Shares) are affected by Apache Vulnerabilities (CVE-2019-10081, CVE-2019-10082, CVE-2019-10092, CVE-2019-10098), )

Summary Aspera Web Applications Faspex, Console, Shares have addressed the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-10081 DESCRIPTION: HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory ...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2018-16845, CVE-2018-16843, CVE-2019-7401)

Summary IBM Aspera Shares has addressed the following OpenSSL vulnerabilities. Vulnerability Details CVEID: CVE-2019-7401 DESCRIPTION: NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a...

Security Bulletin: Aspera Shares application is affected by multiple NGINX Vulnerabilities (CVE-2019-12206, CVE-2019-12207, CVE-2019-12208, CVE-2019-13617, CVE-2018-16845, CVE-2018-16843, CVE-2019-7401)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-7401 DESCRIPTION: NGINX Unit is vulnerable to a denial of service, caused by a heap-based buffer overflow in the router process. By sending a specially-crafted request, a remote...

Security Bulletin: Aspera Web Applications (Faspex, Orchestrator, Shares) and On Demand products are affected by OpenSSL Vulnerabilities (CVE-2018-5407)

Summary Aspera Web Applications Faspex, Orchestrator, Shares and On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitiv...

Security Bulletin: Aspera Web Applications (Faspex, Console) and On Demand products are affected by OpenSSL Vulnerability (CVE-2017-7468)

Summary Aspera Web Applications Faspex, Console and On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID:CVE-2017-7468 DESCRIPTION: No CVE description. CVSS Base Score: 3.1 CVSS Temporal Score: See Not Applicable for the current score CVSS Environment...

Security Bulletin: IBM Aspera Faspex, IBM Aspera Console are affected by OpenSSL Vulnerability (CVE-2018-0739)

Summary IBM Aspera Faspex, IBM Aspera Console have addressed the following OpenSSL vulnerability. Vulnerability Details Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remo...

Security Bulletin: jQuery UI title/default content cross-site scripting (CVE-2012-6662 and CVE-2010-5312)

Question Security Bulletin: jQuery UI title/default content cross-site scripting CVE-2012-6662 and CVE-2010-5312 Answer Abstract: The jQuery UI is vulnerable to cross-site scripting which is caused by improper validation of user-supplied input as well as input by the default content. A remote...

Security Bulletin: Aspera HSTS, HSTE and Desktop Client application is affected by openSSL vulnerabilities (CVE-2017-3735)

Summary Aspera High-Speed Transfer Server formerly known as Enterprise Server and Connect Server, High-Speed Transfer Endpoint formerly known as Point-to-Point Client and Desktop Client application have addressed the following openSSL vulnerabilities. Vulnerability Details CVEID: CVE-2017-3735...

Security Bulletin: Aspera OnDemand is affected by an openSSL vulnerability (CVE-2017-3736)

Summary Aspera OnDemand has addressed the following openSSL vulnerability. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x8664 Montgomery squaring function bnsqrx8xinternal. ...

Security Bulletin: Aspera HSTS, HSTE and Desktop Client application is affected by openSSL vulnerabilities (CVE-2018-0739)

Summary Aspera High-Speed Transfer Server formerly known as Enterprise Server and Connect Server, High-Speed Transfer Endpoint formerly known as Point-to-Point Client and Desktop Client application have addressed the following openSSL vulnerabilities. Vulnerability Details CVEID: CVE-2018-0739...

Security Bulletin: Aspera OnDemand is affected by an openSSL vulnerability (CVE-2018-0739)

Summary Aspera OnDemand has addressed the following openSSL vulnerability. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploit this vulnerability ...

Security Bulletin: Aspera OnDemand is affected by openSSL vulnerabilities (CVE-2017-3738)

Summary Aspera OnDemand has addressed the following openSSL vulnerabilities. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication procedure used in...

Security Bulletin: Aspera HSTS, HSTE and Desktop Client application is affected by openSSL vulnerabilities (CVE-2017-3736)

Summary Aspera High-Speed Transfer Server formerly known as Enterprise Server and Connect Server, High-Speed Transfer Endpoint formerly known as Point-to-Point Client and Desktop Client application have addressed the following openSSL vulnerabilities. Vulnerability Details CVEID: CVE-2017-3736...