Ibm Aspera Faspex vulnerabilities

CVE-2023-27874 [HIGH] CWE-611 CVE-2023-27874: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processi IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

CVE-2023-27873 [MEDIUM] CVE-2023-27873: IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.

CVE-2023-27875 [HIGH] CWE-284 CVE-2023-27875: IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

CVE-2022-47986 [CRITICAL] CWE-502 CVE-2022-47986: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2

CVE-2023-22868 [MEDIUM] CWE-79 CVE-2023-22868: IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to em IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244117.

CVE-2022-22497 [HIGH] CVE-2022-22497: IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed sec IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.