Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

17 records

Vendor: IBM Component: Aspera Shares Clear all filters
TI-2025-40911 CVE-2025-66487 · GHSA-239w-6x3x-fvrr

Multiple vulnerabilities have been addressed in IBM Aspera Shares

Priority LOW 29

IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00346 Published 2026-04-01 No fix listed CWE-770
TI-2025-40909 CVE-2025-66485 · GHSA-p56q-w8c2-56v9

Multiple vulnerabilities have been addressed in IBM Aspera Shares

Priority LOW 24

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00208 Published 2026-04-01 No fix listed CWE-644
TI-2025-40907 CVE-2025-66483 · GHSA-4rp7-5w2x-wwvh

Multiple vulnerabilities have been addressed in IBM Aspera Shares

Priority LOW 28

IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00183 Published 2026-04-01 No fix listed CWE-613
TI-2025-12718 CVE-2025-13916 · GHSA-4f66-hqm2-85m5

Multiple vulnerabilities have been addressed in IBM Aspera Shares

Priority LOW 32

IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00211 Published 2026-04-01 No fix listed CWE-327
TI-2025-00123 CVE-2025-0162 · GHSA-xvw8-mqg6-cchx

IBM Aspera Shares XML external entity injection

Priority LOW 32

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00503 Published 2025-03-07 No fix listed CWE-611
TI-2024-37384 CVE-2024-56473 · GHSA-gvrr-q7f9-rx5j

IBM Aspera Shares Data Manipulation

Priority LOW 30

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00283 Published 2025-02-05 No fix listed CWE-117
TI-2024-37383 CVE-2024-56472 · GHSA-5mr2-544h-qvrm

IBM Aspera Shares Cross-Site Scripting

Priority LOW 28

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00223 Published 2025-02-05 No fix listed CWE-79
TI-2024-37382 CVE-2024-56471 · GHSA-2xhr-8668-crpg

IBM Aspera Shares Server-Side Request Forgery

Priority LOW 24

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00215 Published 2025-02-05 No fix listed CWE-918
TI-2024-37381 CVE-2024-56470 · GHSA-cwfv-c5m6-g8w3

IBM Aspera Shares Server-Side Request Forgery

Priority LOW 24

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00215 Published 2025-02-05 No fix listed CWE-918
TI-2024-25592 CVE-2024-38318 · GHSA-jh56-m69f-g6q7

IBM Aspera Shares HTML injection

Priority LOW 27

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00268 Published 2025-02-05 No fix listed CWE-80
TI-2024-25591 CVE-2024-38317 · GHSA-xmf5-qc8w-4p4r

IBM Aspera Shares Cross-Site Scripting

Priority LOW 21

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00223 Published 2025-02-05 No fix listed CWE-79
TI-2024-25590 CVE-2024-38316 · GHSA-44w2-c6gq-2xxx

IBM Aspera Shares Denial of Service

Priority LOW 29

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00383 Published 2025-02-05 No fix listed CWE-770
TI-2024-25589 CVE-2024-38315 · GHSA-gc2c-r5jf-whf8

IBM Aspera Shares session fixation

Priority LOW 28

IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00227 Published 2024-09-16 No fix listed CWE-613
TI-2023-19443 CVE-2023-38018 · GHSA-64r8-pw62-6prc

IBM Aspera Shares session fixation

Priority LOW 28

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00375 Published 2024-08-09 No fix listed CWE-384
TI-2020-04021 CVE-2020-4731 · GHSA-fw54-qvjj-883j

Cross-site scripting in IBM Aspera Shares

Priority LOW 29

IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0073 Published 2020-09-21 No fix listed CWE-79