CVE-2023-26288

CVE-2023-26288 affects IBM Aspera Orchestrator 4.0.1 and earlier; the root cause is that the session is not invalidated after a password change, enabling an authenticated user to impersonate another user on the system. Reported impact in CVSS is Low to Low/Medium (Confidentiality, Integrity, Avai...

CVE-2023-37407

IBM Aspera Orchestrator 4.0.1 is affected by a remote OS command injection (CVE-2023-37407) due to the product failing to properly filter construct command characters, allowing a remote authenticated attacker to execute arbitrary commands via a specially crafted request. Root cause: inadequate in...

CVE-2023-26289

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection caused by improper validation of HOST headers. The issue affects IBM Aspera Orchestrator (server-side HTTP code) and can enable cross-site scripting, cache poisoning, or session hijacking, reported with CVSS ~5.4 (Network, Low c...

CVE-2023-38001

IBM Aspera Orchestrator 4.0.1 and prior versions are vulnerable to cross-site request forgery (CSRF), allowing an attacker to perform malicious, unauthorized actions via a trusted user. The issue is documented by IBM and affects the product as specified; remediation is to apply the fix for 4.0.1 ...

CVE-2023-27283

Affected product: IBM Aspera Orchestrator 4.0.1. The issue allows a remote attacker to enumerate usernames due to observable response discrepancies during authentication, as documented in multiple sources (e.g., CNVD, Red Hat advisory, IBM X-Force references). Root cause and exact impact: observa...

CVE-2025-13213

CVE-2025-13213 affects IBM Aspera Orchestrator versions 3.0.0–4.1.2. The root cause is improper validation of input in the HOST headers, enabling HTTP header injection that could lead to cross-site scripting, cache poisoning, or session hijacking. Remediation is available in IBM Aspera Orchestrat...

CVE-2025-13214

CVE-2025-13214 affects IBM Aspera Orchestrator versions 4.0.0–4.1.0. The Red Hat/IBM/NVD entries describe a SQL injection vulnerability stemming from improper handling of SQL statements, enabling a remote attacker to view, add, modify, or delete data in the back-end database. No exploit details a...

CVE-2025-13148

CVE-2025-13148 affects IBM Aspera Orchestrator 4.0.0–4.1.0. The issue allows an authenticated user to change another user’s password without knowing the target’s password (unverified password change). CVSS-based details in the sources indicate high impact on confidentiality/integrity for this vec...

CVE-2025-13211

IBM Aspera Orchestrator 4.0.0–4.1.0 is affected by a denial-of-service vulnerability in the email service due to improper control of interaction frequency. An authenticated user could trigger the DoS. Affected versions should upgrade to 4.1.1 for remediation (Linux) per IBM Security Bulletin CVE-...

CVE-2025-13219

CVE-2025-13219 affects IBM Aspera Orchestrator versions 3.0.0–4.1.2. The vulnerability stems from storing sensitive data in URL parameters, potentially exposing confidential information via server logs, referrer headers, or browser history. The Red Hat/IBM advisories and IBM security bulletin con...

CVE-2025-13481

IBM Aspera Orchestrator versions 4.0.0–4.1.0 contain a CVE-2025-13481 command injection due to improper validation of user input. An authenticated user could execute arbitrary commands with elevated privileges on the host. The issue is described across multiple sources (NVD, Red Hat, CNNVD, CVE l...