Filtered by vendor Ibm Subscriptions
Filtered by product Aspera Shares Subscriptions
Total 11 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-0162 1 Ibm 1 Aspera Shares 2025-03-13 7.1 High
IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2024-56470 1 Ibm 1 Aspera Shares 2025-03-07 5.4 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2024-38317 1 Ibm 1 Aspera Shares 2025-03-07 4.8 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-38318 1 Ibm 1 Aspera Shares 2025-03-07 4.8 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2024-56471 1 Ibm 1 Aspera Shares 2025-03-07 5.4 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2024-56472 1 Ibm 1 Aspera Shares 2025-03-07 6.4 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-56473 1 Ibm 1 Aspera Shares 2025-03-06 5.3 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers.
CVE-2024-38316 1 Ibm 1 Aspera Shares 2025-03-06 4.3 Medium
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
CVE-2020-4731 1 Ibm 1 Aspera Shares 2024-11-21 6.1 Medium
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055.
CVE-2024-38315 1 Ibm 1 Aspera Shares 2024-09-20 6.3 Medium
IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
CVE-2023-38018 1 Ibm 1 Aspera Shares 2024-08-29 6.3 Medium
IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574.