AF
Product
Aspera Faspex
On CISA KEVExploited in the wildRansomware-linked
49
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 29Low 2
Watch
Add Aspera Faspex to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-36040 | 6.5 | Jul 30 | IBM Aspera Faspex session fixation Affected: 5.0.0 through 5.0.12.1 |
| CVE-2025-36039 | 6.5 | Jul 30 | IBM Aspera Faspex bypass security Affected: 5.0.0 through 5.0.12.1 |
| CVE-2024-45096 | 6.5 | Sep 5 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.9 |
| CVE-2023-27279 | 6.5 | Apr 19 | IBM Aspera Faspex denial of service Affected: 5.0.0 through 5.0.7 |
| CVE-2022-22399 | 6.5 | Mar 5 | IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers Affected: 5.0.0; 5.0.1 |
| CVE-2023-27873 | 6.5 | Mar 21 | IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input Affected: through 4.4.2; 4.4.2; 4.4.2 |
| CVE-2025-33138 | 6.1 | May 22 | IBM Aspera Faspex HTML injection Affected: 5.0.0 through 5.0.12 |
| CVE-2022-22405 | 5.9 | Sep 8 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: through 5.0.5 |
| CVE-2023-22870 | 5.9 | Sep 5 | IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques Affected: through 5.0.5 |
| CVE-2022-40745 | 5.5 | Apr 19 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.7 |
| CVE-2023-37396 | 5.5 | Apr 19 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.7 |
| CVE-2023-22869 | 5.5 | Apr 19 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.7 |
| CVE-2025-36226 | 5.4 | Mar 10 | Multiple vulnerabilities in IBM Aspera Faspex Affected: 5.0.0 before 5.0.15 |
| CVE-2025-36227 | 5.4 | Mar 10 | Multiple vulnerabilities in IBM Aspera Faspex Affected: 5.0.0 before 5.0.15 |
| CVE-2025-36230 | 5.4 | Dec 26 | XSS in IBM Aspera Faspex Affected: 5.0.0 before 5.0.14.2 |
| CVE-2025-3423 | 5.4 | Apr 13 | IBM Aspera Faspex 5 cross-site scripting Affected: 5.0.0 through 5.0.11 |
| CVE-2023-37411 | 5.4 | May 28 | IBM Aspera Faspex cross-site scripting Affected: 5.0.0 through 5.0.6 |
| CVE-2022-40744 | 5.4 | Feb 2 | IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting Affected: before 5.0.7 |
| CVE-2022-22402 | 5.4 | Sep 8 | IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting Affected: through 5.0.5 |
| CVE-2023-22868 | 5.4 | Feb 17 | IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting Affected: through 4.4.1; 4.4.1 |
| CVE-2023-37401 | 5.3 | Oct 9 | IBM Aspera Faspex cross-origin resource sharing Affected: 5.0.0 through 5.0.13.1 |
| CVE-2023-37413 | 5.3 | Jan 29 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.10 |
| CVE-2022-22409 | 5.3 | Sep 8 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration Affected: through 5.0.5 |
| CVE-2023-24965 | 5.3 | Sep 8 | IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor Affected: through 5.0.5 |
| CVE-2025-36171 | 4.9 | Oct 9 | IBM Aspera Faspex denial of service Affected: 5.0.0 through 5.0.13.1 |
| CVE-2023-37412 | 4.9 | Jan 29 | IBM Aspera Faspex improper access control Affected: 5.0.0 through 5.0.10 |
| CVE-2023-37397 | 4.4 | Apr 19 | IBM Aspera Faspex data manipulation Affected: 5.0.0 through 5.0.7 |
| CVE-2025-36229 | 4.3 | Dec 26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex Affected: 5.0.0 before 5.0.14.2 |
| CVE-2025-36225 | 4.3 | Oct 9 | IBM Aspera Faspex information disclosure Affected: 5.0.0 through 5.0.13.1 |
Showing 29