AF
Product
Aspera Faspex
On CISA KEVExploited in the wildRansomware-linked
49
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 29Low 2
Watch
Add Aspera Faspex to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47986 RansomwareIn wildKEV | 9.8 | Feb 17 | IBM Aspera Faspex code execution Affected: 4.4.2 Patch Level 1 and earlier |
| CVE-2023-37398 | 9.8 | Jan 29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 5.0.0 through 5.0.10 |
| CVE-2023-35907 | 9.8 | Jan 29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 5.0.0 through 5.0.10 |
| CVE-2025-33137 | 8.8 | May 22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to… Affected: 5.0.0 before 5.0.12.1 |
| CVE-2025-33136 | 8.8 | May 22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper… Affected: 5.0.0 before 5.0.12.1 |
| CVE-2023-27874 | 8.8 | Mar 21 | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data Affected: through 4.4.2; 4.4.2; 4.4.2 |
| CVE-2026-14996 | 8.2 | Jul 28 | Multiple vulnerabilities in IBM Aspera Faspex Affected: 5.0.0 before 5.0.16 |
| CVE-2024-45098 | 8.1 | Sep 5 | IBM Aspera Faspex bypass security Affected: 5.0.0 through 5.0.9 |
| CVE-2023-37400 | 7.8 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage Affected: 5.0.0 before 5.0.8 |
| CVE-2022-22401 | 7.5 | Sep 8 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information Affected: through 5.0.5 |
| CVE-2023-30995 | 7.5 | Sep 8 | IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request Affected: through 5.0.5 |
| CVE-2023-35906 | 7.5 | Sep 5 | IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls Affected: through 5.0.5 |
| CVE-2023-27871 | 7.5 | Mar 21 | IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query Affected: through 4.4.2; 4.4.2; 4.4.2 |
| CVE-2023-27875 | 7.5 | Mar 16 | IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls Affected: 5.0.4 |
| CVE-2022-22497 | 7.5 | May 24 | IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token Affected: 4.4.1; 5.0.0 |
| CVE-2026-14958 | 7.2 | Jul 28 | OS command injection in IBM Aspera Faspex Affected: 5.0.0 before 5.0.16 |
| CVE-2026-14959 | 7.2 | Jul 28 | OS Command Injection in IBM Aspera Faspex Affected: 5.0.0 before 5.0.16 |
| CVE-2024-45097 | 7.1 | Sep 5 | IBM Aspera Faspex bypass security Affected: 5.0.0 through 5.0.9 |
| CVE-2025-36040 | 6.5 | Jul 30 | IBM Aspera Faspex session fixation Affected: 5.0.0 through 5.0.12.1 |
| CVE-2025-36039 | 6.5 | Jul 30 | IBM Aspera Faspex bypass security Affected: 5.0.0 through 5.0.12.1 |
| CVE-2024-45096 | 6.5 | Sep 5 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.9 |
| CVE-2023-27279 | 6.5 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting Affected: 5.0.0 through 5.0.7 |
| CVE-2022-22399 | 6.5 | Mar 5 | IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers Affected: 5.0.0; 5.0.1 |
| CVE-2023-27873 | 6.5 | Mar 21 | IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input Affected: through 4.4.2; 4.4.2; 4.4.2 |
| CVE-2025-33138 | 6.1 | May 22 | IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection Affected: 5.0.0 before 5.0.12.1 |
| CVE-2022-22405 | 5.9 | Sep 8 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: through 5.0.5 |
| CVE-2023-22870 | 5.9 | Sep 5 | IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques Affected: through 5.0.5 |
| CVE-2022-40745 | 5.5 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security Affected: 5.0.0 through 5.0.7 |
| CVE-2023-37396 | 5.5 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data Affected: 5.0.0 before 5.0.8 |
| CVE-2023-22869 | 5.5 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user Affected: 5.0.0 before 5.0.8 |
| CVE-2025-36226 | 5.4 | Mar 10 | Multiple vulnerabilities in IBM Aspera Faspex Affected: 5.0.0 before 5.0.15 |
| CVE-2025-36227 | 5.4 | Mar 10 | Multiple vulnerabilities in IBM Aspera Faspex Affected: 5.0.0 before 5.0.15 |
| CVE-2025-36230 | 5.4 | Dec 26 | XSS in IBM Aspera Faspex Affected: 5.0.0 before 5.0.14.2 |
| CVE-2025-3423 | 5.4 | Apr 13 | IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting Affected: 5.0.0 before 5.0.12 |
| CVE-2023-37411 | 5.4 | May 28 | IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting Affected: 5.0.0 through 5.0.6 |
| CVE-2022-40744 | 5.4 | Feb 2 | IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting Affected: before 5.0.7 |
| CVE-2022-22402 | 5.4 | Sep 8 | IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting Affected: through 5.0.5 |
| CVE-2023-22868 | 5.4 | Feb 17 | IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting Affected: through 4.4.1; 4.4.1 |
| CVE-2023-37401 | 5.3 | Oct 9 | IBM Aspera Faspex cross-origin resource sharing Affected: 5.0.0 through 5.0.13.1 |
| CVE-2023-37413 | 5.3 | Jan 29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy Affected: 5.0.0 through 5.0.10 |
| CVE-2022-22409 | 5.3 | Sep 8 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration Affected: through 5.0.5 |
| CVE-2023-24965 | 5.3 | Sep 8 | IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor Affected: through 5.0.5 |
| CVE-2025-36171 | 4.9 | Oct 9 | IBM Aspera Faspex denial of service Affected: 5.0.0 through 5.0.13.1 |
| CVE-2023-37412 | 4.9 | Jan 29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls Affected: 5.0.0 through 5.0.10 |
| CVE-2023-37397 | 4.4 | Apr 19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data Affected: 5.0.0 through 5.0.7 |
| CVE-2025-36229 | 4.3 | Dec 26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex Affected: 5.0.0 before 5.0.14.2 |
| CVE-2025-36225 | 4.3 | Oct 9 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.13.1 |
| CVE-2025-36228 | 3.8 | Dec 26 | Incorrect Execution-Assigned Permissions in IBM Aspera Faspex Affected: 5.0.0 before 5.0.14.2 |
| CVE-2023-37395 | 3.3 | Dec 11 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data Affected: 5.0.0 through 5.0.7 |
Showing 49