IBM Aspera Connect vulnerabilities

5 CVEs affecting IBM Aspera Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27285, published 2023-06-05.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-4545, published 2020-09-04. High severity, CVSS 7.8. EPSS: 3% chance of exploitation in the next 30 days. IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to…
• CVE-2023-27286, published 2023-04-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…
• CVE-2023-27284, published 2023-04-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…
• CVE-2023-22862, published 2023-06-05. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
• CVE-2023-27285, published 2023-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the…