Security Bulletin: IBM Aspera Faspex 5 has addressed multiple vulnerabilities (CVE-2024-45097, CVE-2024-45096, CVE-2024-45098)

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Aspera Faspex 5.0.10 Vulnerability Details CVEID:CVE-2024-45097 DESCRIPTION: IBM Aspera Faspex could allow a user to bypass intended access restrictions and conduct resource modification. CVSS Base...

Security Bulletin: IBM Aspera Shares is vulnerable to multiple medium and low vulnerabilities (CVE-2023-2650, CVE-2018-25032, CVE-2021-3712, CVE-2021-4160, CVE-2023-0466, CVE-2023-0465)

Summary This Security Bulletin addresses multiple medium and low severity vulnerabilities that have been remediated in IBM Aspera Shares 1.10.0 PL4. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly...

CVE-2023-38018

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...

CVE-2023-38018

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...

CVE-2023-38018

IBM Aspera Shares 1.10.0 PL2 contains a vulnerability where a session is not invalidated after a password change, potentially allowing an authenticated user to impersonate another user. Affected product: IBM Aspera Shares; versions up to and including 1.10.0 PL2. Root cause: improper session hand...

CVE-2023-38018 IBM Aspera Shares session fixation

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...

CVE-2023-38018 IBM Aspera Shares session fixation

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574...

PT-2024-12678 · Ibm · Ibm Aspera Shares

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares version 1.10.0 PL2 Description: The issue arises from the software's failure to invalidate a session after a password change, potentially allowing an authenticated user to impersonate another user on the system. This flaw in...

Security Bulletin: IBM Aspera Shares improved security for user session handling (CVE-2023-38018)

Summary IBM Aspera Shares has addressed a vulnerability related to user session handling. Vulnerability Details CVEID:CVE-2023-38018 DESCRIPTION: IBM Aspera Shares does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system...

IBM Aspera Orchestrator Cross-Site Request Forgery Vulnerability

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide data-driven organizations with an efficient document processing pipeline. A cross-site request forgery vulnerability exists in IBM Aspera Orchestrator version 4.0.1. An attacker could...

IBM Aspera Orchestrator HTTP Header Injection Vulnerability

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide data-driven organizations with an efficient document processing pipeline. An HTTP header injection vulnerability exists in IBM Aspera Orchestrator version 4.0.1, which can be exploited...

CVE-2023-38001

IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260206...

CVE-2023-38001

IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260206...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Forc...

CVE-2023-26288

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...

CVE-2023-26288

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...

CVE-2023-26288 IBM Aspera Orchestrator session fixation

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...

CVE-2023-26288 IBM Aspera Orchestrator session fixation

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477...

CVE-2023-26288

CVE-2023-26288 affects IBM Aspera Orchestrator 4.0.1 and earlier; the root cause is that the session is not invalidated after a password change, enabling an authenticated user to impersonate another user on the system. Reported impact in CVSS is Low to Low/Medium (Confidentiality, Integrity, Avai...