Ibm

Aspera Faspex

46 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2025-36226

  • EPSS 0.03%
  • Veröffentlicht 10.03.2026 19:59:35
  • Zuletzt bearbeitet 12.03.2026 15:40:02

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...

5.4

CVE-2025-36227

  • EPSS 0.03%
  • Veröffentlicht 10.03.2026 19:57:16
  • Zuletzt bearbeitet 12.03.2026 15:36:29

IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-sit...

5.4

CVE-2025-36230

  • EPSS 0.04%
  • Veröffentlicht 26.12.2025 14:22:46
  • Zuletzt bearbeitet 29.12.2025 17:42:46

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

4.3

CVE-2025-36229

  • EPSS 0.01%
  • Veröffentlicht 26.12.2025 14:15:03
  • Zuletzt bearbeitet 29.12.2025 18:10:45

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.

3.8

CVE-2025-36228

  • EPSS 0.01%
  • Veröffentlicht 26.12.2025 14:11:45
  • Zuletzt bearbeitet 29.12.2025 18:15:10

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.

4.9

CVE-2025-36171

  • EPSS 0.07%
  • Veröffentlicht 09.10.2025 14:15:54
  • Zuletzt bearbeitet 14.10.2025 20:18:22

IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.

4.3

CVE-2025-36225

  • EPSS 0.03%
  • Veröffentlicht 09.10.2025 13:56:19
  • Zuletzt bearbeitet 14.10.2025 20:18:48

IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.

5.3

CVE-2023-37401

  • EPSS 0.03%
  • Veröffentlicht 09.10.2025 13:54:38
  • Zuletzt bearbeitet 14.10.2025 20:18:35

IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.

6.5

CVE-2025-36040

  • EPSS 0.03%
  • Veröffentlicht 30.07.2025 23:48:52
  • Zuletzt bearbeitet 06.08.2025 16:53:32

IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.

6.5

CVE-2025-36039

  • EPSS 0.03%
  • Veröffentlicht 30.07.2025 23:47:25
  • Zuletzt bearbeitet 06.08.2025 16:54:00

IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms,