CVE-2022-47986

Summary: CVE-2022-47986 affects IBM Aspera Faspex 4.4.2 PL1 and earlier due to a YAML deserialization flaw that allowed remote code execution. The vulnerability is triggered by a specially crafted obsolete API call; the obsolete call was removed in Faspex 4.4.2 PL2. IBM’s bulletin confirms remedi...

CVE-2023-30995

CVE-2023-30995 affects IBM Aspera Faspex 4.0–4.4.2 and 5.0–5.0.5, where a malicious actor could bypass IP whitelist restrictions by sending a specially crafted HTTP request. The CVSS v3.1 score is 7.5 (HIGH); impact is confined to confidentiality none, integrity high, availability none, with netw...

CVE-2025-33138

CVE-2025-33138 affects IBM Aspera Faspex 5.0.0–5.0.12. The vulnerability is HTML injection, allowing a remote attacker to inject HTML that runs in a user’s browser within the hosting site’s security context. IBM’s bulletin reiterates the issue and reports remediation: upgrade to Faspex 5.0.12.1. ...

CVE-2022-22399

IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by an HTTP header injection flaw caused by improper validation of the HOST header. The vulnerability can enable cross‑site scripting, cache poisoning, or session hijacking against vulnerable installations. Affected products: IBM Aspera Faspex 5.0.0 a...

CVE-2023-22868

CVE-2023-22868 affects IBM Aspera Faspex 4.4.1 with a cross-site scripting (XSS) vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue is addressed in IBM Faspex 4.4.2 PL2; remediation is to upgrade to 4.4....

CVE-2023-27279

The vulnerability CVE-2023-27279 affects IBM Aspera Faspex 5.0.0–5.0.7 and is caused by missing API rate limiting, enabling denial of service. Remediation is to upgrade to Faspex 5.0.8 (IBM advisory notes this fix). Impact is rated MEDIUM (CVSS 3.1 base score 6.5); no exploitation details are pro...

CVE-2023-24965

CVE-2023-24965 affects IBM Aspera Faspex 5.0.5 (and earlier) and is due to improper access control that allows an unauthorized actor to access a resource. Multiple sources (IBM security bulletin and Red Hat/NVD records) confirm the issue and cite a remediation: upgrade to Faspex 5.0.6 to address ...

CVE-2023-27874

CVE-2023-27874 affects IBM Aspera Faspex 4.4.2. The vulnerability is an XML External Entity (XXE) injection when processing XML data, enabling a remote authenticated attacker to execute arbitrary commands. IBM X-Force lists the impact as high to critical, with a base score up to 9.9 (CRITICAL in ...

CVE-2022-22402

Consolidated details for CVE-2022-22402 show IBM Aspera Faspex 5.0.5 (and earlier) vulnerable to cross-site scripting in the Web UI, enabling embedding of arbitrary JavaScript that could lead to credentials disclosure within a trusted session. The underlying issue is a Web UI XSS flaw; exploitati...

CVE-2022-22405

CVE-2022-22405 affects IBM Aspera Faspex 5.0.5 and prior, caused by failure to properly enable HTTP Strict Transport Security. This allows a remote attacker to obtain sensitive information via MITM techniques (confidentiality impact C:H, CVSS 3.1 base 5.9). Connected sources confirm the issue and...

CVE-2022-22409

CVE-2022-22409 affects IBM Aspera Faspex 5.0.5 and earlier, where an insecure configuration can let a remote attacker gather sensitive information from the web application. The available connected documents confirm the root cause as a misconfiguration, leading to information disclosure with a bas...

CVE-2022-22401

CVE-2022-22401 affects IBM Aspera Faspex 5.0.5 and earlier, where a remote attacker could cause a user to disclose sensitive information (information disclosure). The exact technical root cause details are not provided in the documents, but remediation is to upgrade to Faspex 5.0.6 (Linux) as not...

CVE-2023-22870

CVE-2023-22870 affects IBM Aspera Faspex 5.0.5 and earlier, where sensitive data is transmitted in cleartext, enabling potential eavesdropping via man-in-the-middle attacks. The issue’s CVSS base score is 5.9 (MEDIUM) with network access and high attack complexity, requiring no privileges or user...

CVE-2023-37413

IBM Aspera Faspex ≤ 5.0.10 is affected by an information-disclosure vulnerability (CVE-2023-37413) caused by an observable response discrepancy that could reveal sensitive username information. Affected product/versions: IBM Aspera Faspex 5.0.0 through 5.0.10. Remediation: upgrade to IBM Aspera F...

CVE-2023-37395

CVE-2023-37395 affects IBM Aspera Faspex 5.0.0–5.0.7, where a local user could obtain sensitive information due to improper encryption of certain data. The Red Hat and other security sources corroborate an information disclosure vulnerability in Faspex 5.x, with the IBM bulletin explicitly listin...

CVE-2025-3423

IBM Aspera Faspex 5.x (versions 5.0.0–5.0.11) is affected by a DOM-based cross-site scripting vulnerability that lets an authenticated user embed arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. The issue stems from inadequate input handli...

CVE-2023-37397

IBM Aspera Faspex versions 5.0.0–5.0.7 have a trust/encryption issue where data is improperly encrypted, allowing a local user to obtain or modify sensitive information. This vulnerability is documented across multiple sources (IBM bulletin, NVD, CNVD/CNNVD) with the affected product/version rang...

CVE-2023-37412

CVE-2023-37412 affects IBM Aspera Faspex 5.0.0–5.0.10. The vulnerability is an improper access control that could let a privileged user make system changes. IBM’s advisory notes remediation in Faspex 5.0.11. Current sources show CVSS base score ~4.4–4.9 depending on vector; exploitation status is...

CVE-2022-22497

CVE-2022-22497 affects IBM Aspera Faspex 4.4.1 and 5.0.0, where an incorrectly computed security token could allow unauthorized access. The IBM security bulletins and related entries (IBM Aspera Faspex) confirm the affected versions and describe the root cause as token miscalculation leading to d...

CVE-2023-27875

IBM Aspera Faspex 5.0.4 is affected by an improper access control vulnerability (CVE-2023-27875) where an unauthenticated user could change other users’ credentials. Affected product: IBM Aspera Faspex 5.0.4 (container image faspex_core). Root cause: access-control weaknesses allow credential cha...

CVE-2023-37411

CVE-2023-37411 affects IBM Aspera Faspex 5.0.0–5.0.6, where an input validation/escaping flaw enables stored cross-site scripting in the Web UI, potentially leading to credential disclosure within a trusted session. The issue stems from inadequate filtering of user-supplied data in Faspex and is ...

CVE-2025-33137

Affected product: IBM Aspera Faspex 5 (versions 5.0.0–5.0.12). Vulnerability cause: client-side enforcement of server-side security enables an authenticated user to access sensitive information or perform actions on behalf of another user. Impact: potential disclosure of sensitive data and unauth...

CVE-2023-22869

CVE-2023-22869 affects IBM Aspera Faspex 5.0.0–5.0.7. The vulnerability arises from storing potentially sensitive information in log files that a local user could read, impacting confidentiality (CVSS: 3.1, LOCAL access, LOW privilege). Affected products/versions are explicitly listed as Faspex 5...

CVE-2023-27871

CVE-2023-27871 affects IBM Aspera Faspex 4.4.2. A remote attacker could obtain sensitive credential information for an external user via a specially crafted SQL query, indicating an SQL injection in Faspex’s handling of external input. The related Red Hat/NCSC entries and IBM security bulletin co...

CVE-2023-35906

IBM Aspera Faspex 5.0.5 and earlier versions are affected by CVE-2023-35906, where improper access controls allow a remote attacker to bypass IP restrictions. The issue is an unauthorized access control flaw in Faspex’s handling of IP-based access, enabling bypass of IP whitelisting. Remediation ...

CVE-2025-33136

CVE-2025-33136 affects IBM Aspera Faspex 5 (versions 5.0.0–5.0.12). The issue is due to improper protection of assumed immutable data (MAID), enabling an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user. According to IBM’s advisory, reme...

CVE-2024-45098

IBM Aspera Faspex 5.0.0–5.0.9 contains a security bypass that can allow a user to bypass intended access restrictions and modify resources. The issue is addressed in Faspex 5.0.10. Affected product: IBM Aspera Faspex (versions 5.0.0–5.0.9). Root cause indicated: bypass of access controls leading ...

CVE-2023-37396

CVE-2023-37396 affects IBM Aspera Faspex 5.0.0–5.0.7, where a local user could obtain sensitive information due to improper encryption of certain data. The issue is documented alongside other encryption vulnerabilities in IBM’s Security Bulletin for Aspera Faspex, which notes that Faspex 5.0.8 ad...

CVE-2023-27873

Summary: CVE-2023-27873 affects IBM Aspera Faspex 4.4.2. An authenticated remote attacker could obtain sensitive credential information by sending specially crafted XML input, per multiple sources (IBM X-Force ID 249654; Red Hat bulletin; CNVD/CVE references). The initial records assign a CVSSv3....

CVE-2023-35907

CVE-2023-35907 affects IBM Aspera Faspex versions 5.0.0–5.0.10, where default weak password requirements can allow attacker compromise of user accounts. The cited sources also show remediation: upgrade to Faspex 5.0.11 (IBM) to address the vulnerability. No exploitation details are provided in th...

CVE-2022-40745

CVE-2022-40745 : IBM Aspera Faspex 5.0.0–5.0.7 has an information disclosure vulnerability caused by weaker than expected security, exploitable by a local user to obtain sensitive information. The IBM Security Bulletin confirms remediation by upgrading to Faspex 5.0.8, addressing multiple encrypt...

CVE-2023-37398

IBM Aspera Faspex 5.0.0–5.0.10 are affected by a weakness where strong passwords are not required by default, enabling easier compromise of user accounts. The IBM security bulletin indicates remediation is available in Faspex 5.0.11. Public disclosures across multiple sources (NVD, Red Hat, CVE l...

CVE-2024-45096

Summary: CVE-2024-45096 affects IBM Aspera Faspex 5.0.0–5.0.9, allowing a user with package access to obtain sensitive information through directory listings. Affected product/versions: IBM Aspera Faspex 5.0.0–5.0.9. Root cause/impact: Information disclosure via directory listing; no evidence in ...

CVE-2023-37400

CVE-2023-37400 affects IBM Aspera Faspex 5.0.0–5.0.7; root cause is insecure credential storage that can enable a local user to escalate privileges. IBM PT/IBM bulletin confirms the fix is available in Faspex 5.0.8. Affected products and versions: Aspera Faspex 5.0.0–5.0.7. Remediation: upgrade t...

CVE-2024-45097

IBM Aspera Faspex 5.x versions 5.0.0–5.0.9 contain a security bypass vulnerability that can let an authenticated user bypass access restrictions and modify resources. Multiple connected sources (including IBM Security Bulletin F73E0EBA07F808CC311F1BEE8CD05E8006521D2DA613C5B0AF32FC69B8DD3F65) desc...

CVE-2025-36225

CVE-2025-36225 concerns IBM Aspera Faspex information disclosure: Aspera Faspex versions 5.0.0–5.0.13.1 may disclose sensitive user information to an authenticated user due to an observable discrepancy in returned data. The IBM advisory (IBM Aspera Faspex security bulletin) lists this CVE among m...

CVE-2022-40744

IBM Aspera Faspex 5.x is affected by a stored cross-site scripting (XSS) vulnerability in the Web UI. The issue impacts Faspex 5.0.6 and earlier, arising from improper handling of input in the UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a tru...

CVE-2025-36229

IBM Aspera Faspex 5.x (versions 5.0.0–5.0.14.1) is affected by CVE-2025-36229. Authenticated users may enumerate package identifiers to reveal sensitive data due to an information exposure issue. This is specific to Faspex 5 and arises from the way package metadata can be enumerated, enabling dis...

CVE-2025-36171

CVE-2025-36171 affects IBM Aspera Faspex 5.0.0–5.0.13.1. The issue is an input validation error on API input that can cause a denial of service due to excessive resource consumption when handled by the service. Affected products and versions are confirmed by multiple sources (NVD, Red Hat, CNVD, ...

CVE-2026-14996

IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...

CVE-2025-36040

CVE-2025-36040 affects IBM Aspera Faspex 5.0.0–5.0.12.1. Description in provided documents indicates an authenticated user could perform unauthorized actions due to client-side enforcement of server-side security mechanisms. The vulnerability is documented across multiple feeds (Red Hat, CNVD, NV...

CVE-2026-14958

IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) is affected by a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. The issue is a root cause in shell command handling that enables code execution with high impact (confide...

CVE-2025-36230

CVE-2025-36230 - IBM Aspera Faspex HTML injection is documented in the IBM Security Bulletin. Faspex 5.0.0–5.0.14.1 allows a remote attacker to inject malicious HTML that executes in the victim’s browser within the hosting site’s security context. Mitigation: upgrade Faspex to version 5.0.14.2 (L...

CVE-2025-36039

Summary (CVE-2025-36039) IBM Aspera Faspex 5.0.0–5.0.12.1 contains a vulnerability where an authenticated user can perform unauthorized actions due to client-side enforcement of server-side security mechanisms. The issue is tied to how Faspex handles security checks on the client side, allowing a...

CVE-2026-14959

CVE-2026-14959 affects IBM Aspera Faspex 5, versioned 5.0.0 through 5.0.15.4. The vulnerability allows a remote authenticated attacker to execute arbitrary code via a shell command injection in Faspex components. Root cause: improper input handling enabling shell command execution. Impact: high w...

CVE-2025-36227

CVE-2025-36227 — IBM Aspera Faspex : The issue affects Faspex 5.0.0–5.0.14.3, caused by improper validation of input in HOST headers, leading to HTTP header injection. Documented impacts include cross-site scripting, cache poisoning, and session hijacking. Affected products are IBM Aspera Faspex ...

CVE-2025-36226

CVE-2025-36226 affects IBM Aspera Faspex 5.0.0 through 5.0.14.3. A cross-site scripting flaw allows an authenticated user to inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. Root cause: improper handling of input in the Web UI. I...

CVE-2023-37401

IBM Aspera Faspex 5.0.0–5.0.13.1 is affected by CVE-2023-37401 due to a cross-domain policy file that includes domains that should not be trusted. The issue is documented across multiple feeds, which identify the affected versions and the root cause as a permissive cross-domain policy. Remediatio...

CVE-2025-36228

CVE-2025-36228 affects IBM Aspera Faspex 5 (versions 5.0.0–5.0.14.1). The issue is inconsistent permissions between the UI and backend API, allowing users to access features that appeared disabled and potentially leading to misuse. Red Hat, CIRCL, NVD, and other feeds corroborate the same descrip...