Threat Intelligence Database

IBM Aspera Shares versions 1.9.9 through 1.11.0 have a vulnerability where the software does not properly rate limit the frequency of emails sent by authenticated users. This flaw could allow an authenticated user to send emails excessively, potentially causing email flooding or a denial of service condition. The vulnerability is identified as CWE-770, related to allocation of resources without limits or throttling. The CVSS score is 2.7, indicating a low severity impact. There is no indication of known exploits in the wild.

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM Aspera Shares versions 1.9.9 through 1.11.0 contain a vulnerability due to improper validation of HOST headers, leading to HTTP header injection. This flaw can enable attackers to perform attacks such as cross-site scripting, cache poisoning, or session hijacking. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

IBM Aspera Shares versions 1.9.9 through 1.11.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an attacker to embed arbitrary JavaScript code in the web user interface, which can alter intended functionality and potentially lead to the disclosure of credentials within a trusted session. The vulnerability has a medium severity rating with a CVSS score of 5.5. There is no information about an available patch or official remediation from IBM at this time. No known exploits are reported in the wild.

IBM Aspera Shares versions 1.9.9 through 1.11.0 contain a vulnerability where sessions are not invalidated after a password reset. This insufficient session expiration could allow an authenticated user to impersonate another user on the system. The vulnerability is identified as CWE-613 and has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No official patch or remediation information is provided in the available data.

IBM Aspera Shares versions 1.9.9 through 1.11.0 use cryptographic algorithms that are weaker than expected, potentially allowing attackers to decrypt highly sensitive information. The vulnerability is identified as CWE-327, indicating the use of broken or risky cryptography. The CVSS score is 5.9, reflecting a medium severity level. There is no indication of known exploits in the wild. No official patch or remediation information is provided in the available data.