jexboss

JexBoss - JBoss and others Java Deserialization Vulnerabilities verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc. Requirements Python = 2.7.x urllib3 ipaddress Installatio...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

clusterd

clusterd clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information...

CVE-2026-93905

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to a deserialization of untrusted data (CWE-502) when the batchManagement-1.0 feature is enabled. This vulnerability could allow an unauthenticated remote attacker to corrupt the persisted status of batch ...

CVE-2026-93909

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to an authentication bypass vulnerability when the samlWeb-2.0 feature is enabled. This issue is associated with CWE-384 (Session Fixation) and carries a CVSS 3.1 base score of 9.1 (CRITICAL) . The vulnera...

CVE-2026-93895

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to an Improper Access Control flaw (CWE-284 ). When the grpc-1.0 feature is enabled, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods . This vulnerability...

CVE-2026-95695

IBM WebSphere Application Server - Liberty (versions 20.0.0.12 through 26.0.0.10 ) is vulnerable to incorrect authorization (CWE-863), which could allow a remote attacker to bypass security restrictions. This issue specifically impacts environments where the grpc-1.0 feature is enabled. The impac...

CVE-2026-95696

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to a denial of service (DoS) condition. The root cause is an uncaught exception (CWE-400: Uncontrolled Resource Consumption) that can be triggered by a remote attacker. The vulnerability specifically af...

CVE-2026-101294

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a missing cryptographic step vulnerability (CWE-325 ). The root cause is the improper verification of cryptographic signatures , which could allow a remote attacker to bypass signature verification. Affected...

CVE-2026-105442

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a deserialization of untrusted data vulnerability (CWE-502) within the messaging service. A remote attacker can exploit this flaw to cause a denial of service . Affected products include WebSphere Applicatio...

CVE-2026-105443

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by an improper access control vulnerability (CWE-284) characterized by insufficient isolation between servers sharing an installation. This issue specifically impacts instances with the restConnector-1.0 or ...

CVE-2026-11713

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability (CVE-2026-11713 ) when the restConnector-2.0 feature is enabled. The root cause is identified as Incorrect Authorization (CWE-863 ), which could allow an attacker to ga...

CVE-2026-14532

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to an Integer Overflow (CWE-190) that allows an attacker with Reader-role privileges to obtain version information, which can trigger an uncaught exception . This issue also affects IBM Tivoli Application...

CVE-2026-14909

IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9) is vulnerable to an information disclosure vulnerability (CWE-209). When the restConnector-2.0 feature is enabled, an authenticated attacker can obtain sensitive information through the generation of error messages cont...

CVE-2026-77816

The IBM WebSphere Application Server - Liberty administrative client (versions 17.0.0.3 through 26.0.0.9 ) is vulnerable to a man-in-the-middle attack due to Improper Certificate Validation (CWE-295). An attacker could exploit this flaw to obtain sensitive information. This vulnerability also aff...

CVE-2026-79715

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to a path traversal vulnerability (CWE-22 ). A local attacker can use a specially crafted application archive to traverse directories and write files outside the intended directory. This issue also affect...

CVE-2025-31324

CVE-2025-31324 How does this detection method work? The template performs an HTTP GET request to the target's base URL and examines the response headers to identify SAP NetWeaver Application Server instances. This information helps assess whether the system might be susceptible to CVE-2025-31324...

CVE-2026-93907

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler...

CVE-2026-95680

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell...

CVE-2026-93907 IBM WebSphere Application Server is affected by a bypass authentication vulnerability

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler...