Aspera Orchestrator vulnerabilities
4 known vulnerabilities in Aspera Orchestrator from IBM. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Aspera Orchestrator: Use of HTTP Request With Sensitive Query String
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
- 8.8 High severity
Aspera Orchestrator: Improper Neutralization of Special Elements used in an OS Command
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
- 8.8 High severity
Aspera Orchestrator: Improper Neutralization of Special Elements used in an SQL Command
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- 8.8 High severity
Aspera Orchestrator: Improper Neutralization of Special Elements used in an OS Command
IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116.