CVE-2025-36247

This vulnerability allows an attacker to discover valid usernames within IBM Aspera Console by exploiting differences in system responses. The attacker needs to interact with the application in a way that reveals these discrepancies, which could lead to further attacks like password guessing.

This vulnerability allows a privileged user to disrupt the service by misusing the system's workflow controls, potentially causing downtime. It affects specific versions of IBM Aspera Console, so users running those versions should be cautious about how workflows are managed.

This vulnerability allows an authenticated user to disrupt the email service, potentially causing it to become unavailable for others. It occurs because the system doesn't properly manage how often users can interact with the email service, leading to a denial of service.

This vulnerability allows a remote attacker to access sensitive information from IBM Sterling Partner Engagement Manager due to detailed error messages being exposed. If an attacker can trigger these error messages, they could gather valuable information that might help them launch further attacks on the system.

An attacker can exploit this vulnerability to access sensitive user information by using an expired access token, which means they don't need valid credentials to gain this information. This issue affects specific versions of IBM Sterling Partner Engagement Manager, so organizations using these versions should take immediate action to secure their systems.