Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2024-07-30	CVE-2023-26288	Insufficient Session Expiration vulnerability in IBM Aspera Orchestrator 4.0.1 IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. network low complexity ibm CWE-613	5.5
2024-07-30	CVE-2023-26289	Improper Encoding or Escaping of Output vulnerability in IBM Aspera Orchestrator 4.0.1 IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. network low complexity ibm CWE-116	5.4
2024-07-30	CVE-2023-38001	Cross-Site Request Forgery (CSRF) vulnerability in IBM Aspera Orchestrator 4.0.1 IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. network low complexity ibm CWE-352	6.5