IBM Aspera Cargo vulnerabilities

4 CVEs affecting IBM Aspera Cargo, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27285, published 2023-06-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-27286, published 2023-04-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…
CVE-2023-27284, published 2023-04-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…
CVE-2023-22862, published 2023-06-05. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVE-2023-27285, published 2023-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…