IBM Aspera Orchestrator vulnerabilities

IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation.

IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency. The flaw affects the email sending mechanism and can be triggered remotely by a logged-in user.

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to change the password of another user without prior knowledge of that password.