CVE-2025-33104

🗓️ 14 May 2025 19:01:09Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 58 Views

IBM WebSphere Application Server 8.5 and 9.0 vulnerabilities allow cross-site scripting attacks.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a cross-site scripting vulnerability (CVE-2025-33104)	27 May 202518:19	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM WebSphere Application Server is affected by a cross-site scripting vulnerability (CVE-2025-33104)	30 May 202505:46	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2025-33104)	31 Jul 202505:40	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2025-33104)	30 May 202515:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with WebSphere Remote Server, is affected by a cross-site scripting vulnerability due to user ability to embed arbitrary JavaScript code in the Web UI (CVE-2025-33104)	16 May 202520:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a cross-site scripting vulnerability (CVE-2025-33104)	21 May 202513:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within WebSphere Application and IBM HTTP Server, affect IBM Tivoli Monitoring.	9 Jul 202516:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server is affected by a cross-site scripting vulnerability (CVE-2025-33104)	14 May 202519:50	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2025-33104)	28 May 202506:59	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2025-33104)	9 Jun 202511:54	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5–8.5.5.28

ibm websphere_application_serverRange9.0–9.0.5.24

AND

hp hp-uxMatch-

ibm aixMatch-

ibm iMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

oracle solarisMatch-

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.5, 9.0"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7233438

20 Aug 2025 15:47Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.14.4 - 7.6

EPSS0.00124

SSVC

CWE-79