Ibm Aspera Faspex vulnerabilities

CVE-2022-47986 [CRITICAL] CWE-502 CVE-2022-47986: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2

CVE-2023-27874 [HIGH] CWE-611 CVE-2023-27874: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processi IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

CVE-2023-27871 [HIGH] CWE-89 CVE-2023-27871: IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613.

CVE-2025-33137 [HIGH] CWE-602 CVE-2025-33137: IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive informa IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.

CVE-2025-33136 [HIGH] CWE-471 CVE-2025-33136: IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive informa IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data.

CVE-2023-35907 [CRITICAL] CWE-521 CVE-2023-35907: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by d IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

CVE-2023-37398 [CRITICAL] CWE-521 CVE-2023-37398: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by d IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

CVE-2024-45098 [HIGH] CWE-650 CVE-2024-45098: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.

CVE-2023-30995 [HIGH] CWE-863 CVE-2023-30995: IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. IBM X-Force ID: 254268.

CVE-2022-22401 [HIGH] CWE-311 CVE-2022-22401: IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply s IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567.

CVE-2022-22497 [HIGH] CVE-2022-22497: IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed sec IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.

CVE-2023-37400 [HIGH] CWE-522 CVE-2023-37400: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to i IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677.

CVE-2023-27875 [HIGH] CWE-284 CVE-2023-27875: IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

CVE-2023-35906 [HIGH] CWE-291 CVE-2023-35906: IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper acce IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649.

CVE-2024-45097 [HIGH] CWE-650 CVE-2024-45097: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.

CVE-2025-36039 [MEDIUM] CWE-602 CVE-2025-36039: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized a IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms,

CVE-2025-36040 [MEDIUM] CWE-613 CVE-2025-36040: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized a IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.

CVE-2023-27873 [MEDIUM] CVE-2023-27873: IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.

CVE-2024-45096 [MEDIUM] CWE-548 CVE-2024-45096: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensit IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.

CVE-2023-27279 [MEDIUM] CWE-799 CVE-2023-27279: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.