CVSS: 9.9EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27874 – IBM Aspera Faspex XML external entity injection
https://notcve.org/view.php?id=CVE-2023-27874
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. • https://exchange.xforce.ibmcloud.com/vulnerabilities/249845 https://www.ibm.com/support/pages/node/6964694 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27871 – IBM Aspera Faspex information disclosure
https://notcve.org/view.php?id=CVE-2023-27871
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613. • https://exchange.xforce.ibmcloud.com/vulnerabilities/249613 https://www.ibm.com/support/pages/node/6964694 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-22868 – IBM Aspera Faspex cross-site scripting
https://notcve.org/view.php?id=CVE-2023-22868
IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244117. • https://exchange.xforce.ibmcloud.com/vulnerabilities/244117 https://www.ibm.com/support/pages/node/6952319 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 96%CPEs: 5EXPL: 4CVE-2022-47986 – IBM Aspera Faspex Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-47986
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512. IBM Aspera Faspex version 4.4.1 suffers from a YAML deserialization vulnerability that allows for remote code execution. • https://www.exploit-db.com/exploits/51316 https://github.com/ohnonoyesyes/CVE-2022-47986 https://github.com/dhina016/CVE-2022-47986 https://github.com/mauricelambert/CVE-2022-47986 http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html https://exchange.xforce.ibmcloud.com/vulnerabilities/243512 https://www.ibm.com/support/pages/node/6952319 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22497
https://notcve.org/view.php?id=CVE-2022-22497
IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951. IBM Aspera Faspex versiones 4.4.1 y 5.0.0, podrían permitir el acceso no autorizado debido a un token de seguridad calculado incorrectamente. IBM X-Force ID: 226951 • https://exchange.xforce.ibmcloud.com/vulnerabilities/226951 https://www.ibm.com/support/pages/node/6589601 •