JavaUnserializeExploits

JavaUnserializeExploits Python scripts and HTTP request referenced in the blog post What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability at http://foxglovesecurity.com...

CVE-2026-93905

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to a deserialization of untrusted data (CWE-502) when the batchManagement-1.0 feature is enabled. This vulnerability could allow an unauthenticated remote attacker to corrupt the persisted status of batch ...

CVE-2026-93909

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to an authentication bypass vulnerability when the samlWeb-2.0 feature is enabled. This issue is associated with CWE-384 (Session Fixation) and carries a CVSS 3.1 base score of 9.1 (CRITICAL) . The vulnera...

CVE-2026-93895

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to an Improper Access Control flaw (CWE-284 ). When the grpc-1.0 feature is enabled, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods . This vulnerability...

CVE-2026-95695

IBM WebSphere Application Server - Liberty (versions 20.0.0.12 through 26.0.0.10 ) is vulnerable to incorrect authorization (CWE-863), which could allow a remote attacker to bypass security restrictions. This issue specifically impacts environments where the grpc-1.0 feature is enabled. The impac...

CVE-2026-95696

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to a denial of service (DoS) condition. The root cause is an uncaught exception (CWE-400: Uncontrolled Resource Consumption) that can be triggered by a remote attacker. The vulnerability specifically af...

CVE-2026-101294

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a missing cryptographic step vulnerability (CWE-325 ). The root cause is the improper verification of cryptographic signatures , which could allow a remote attacker to bypass signature verification. Affected...

CVE-2026-105442

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a deserialization of untrusted data vulnerability (CWE-502) within the messaging service. A remote attacker can exploit this flaw to cause a denial of service . Affected products include WebSphere Applicatio...

CVE-2026-105443

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by an improper access control vulnerability (CWE-284) characterized by insufficient isolation between servers sharing an installation. This issue specifically impacts instances with the restConnector-1.0 or ...

CVE-2026-11713

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability (CVE-2026-11713 ) when the restConnector-2.0 feature is enabled. The root cause is identified as Incorrect Authorization (CWE-863 ), which could allow an attacker to ga...

CVE-2026-14532

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to an Integer Overflow (CWE-190) that allows an attacker with Reader-role privileges to obtain version information, which can trigger an uncaught exception . This issue also affects IBM Tivoli Application...

CVE-2026-14909

IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9) is vulnerable to an information disclosure vulnerability (CWE-209). When the restConnector-2.0 feature is enabled, an authenticated attacker can obtain sensitive information through the generation of error messages cont...

CVE-2026-77816

The IBM WebSphere Application Server - Liberty administrative client (versions 17.0.0.3 through 26.0.0.9 ) is vulnerable to a man-in-the-middle attack due to Improper Certificate Validation (CWE-295). An attacker could exploit this flaw to obtain sensitive information. This vulnerability also aff...

CVE-2026-79715

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to a path traversal vulnerability (CWE-22 ). A local attacker can use a specially crafted application archive to traverse directories and write files outside the intended directory. This issue also affect...

CVE-2026-93907

IBM WebSphere Application Server versions 8.5 and 9.0 are affected by a vulnerability that allows a remote attacker to bypass authentication. The root cause is a flaw in the CSIv2 inbound propagation handler (CWE-287: Improper Authentication). Successful exploitation can lead to high impacts on c...

CVE-2026-95680

IBM WebSphere Application Server versions 8.5 and 9.0 are affected by an improper authentication vulnerability (CWE-287 ). This flaw could allow an authenticated attacker to bypass authorization, potentially leading to administrative impersonation across the cell. To remediate this, IBM recommend...

CVE-2026-103499

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption (CWE-400). This flaw allows a remote, unauthenticated attacker to exhaust system resources. Affected Products and Versions: WebSphe...

serialator

serialator Python script to exploit CVE-2015-4852. Description During a recent engagement, I found that Nessus was now actively exploiting vulnerabilities for confirmation. When I checked the associated nasl script I found that the payload was generic enough to be used on a standalone script...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-65432, CVE-2026-66142, CVE-2026-66143, CVE-2026-66144, CVE-2026-49875, CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-15396, CVE-2026-15412, CVE-2026-15634 in WebSphere Application Server WAS Liberty as...

WebSphere-WSIF-gadget

WSIF Gadget for WebSphere CVE-2020-4464 / CVE-2020-4450 This is based on the excellent blog posts of ZDI original report by @tint0: https://www.thezdi.com/blog/2020/7/20/abusing-java-remote-protocols-in-ibm-websphere...