Websphere Application Server@* Security Vulnerabilities and Issues — Page 2 of Websphere Application Server@* CVE List

Lucene search

IbmWebsphere Application Server*

167 matches found

CVE•added 2018/10/31 1:29 p.m.•72 views

CVE-2018-1851

IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-...

9.8CVSS9.4AI score0.05391EPSS

CVE•added 2019/03/11 10:29 p.m.•71 views

CVE-2018-1902

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531.

4.3CVSS4.5AI score0.00277EPSS

CVE•added 2021/04/08 1:15 p.m.•70 views

CVE-2021-20480

IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502.

6.5CVSS6.3AI score0.0034EPSS

CVE•added 2018/11/15 4:29 p.m.•69 views

CVE-2018-1643

The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

6.1CVSS5.8AI score0.00436EPSS

CVE•added 2010/06/18 6:30 p.m.•68 views

CVE-2010-2323

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated with profile creation by the BBOWWPFx job and the zPMT.

5CVSS6.1AI score0.00301EPSS

CVE•added 2021/05/26 5:15 p.m.•68 views

CVE-2021-20492

IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.

8.2CVSS8AI score0.00022EPSS

CVE•added 2020/02/04 5:15 p.m.•67 views

CVE-2020-4163

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.

7.2CVSS6.7AI score0.00418EPSS

CVE•added 2021/04/20 12:15 p.m.•67 views

CVE-2021-20453

IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.

8.2CVSS7.9AI score0.00132EPSS

CVE•added 2002/06/25 4:0 a.m.•66 views

CVE-2001-0962

IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privileges of WebSphere users via brute force guessing.

7.5CVSS7.2AI score0.01053EPSS

CVE•added 2016/06/06 5:59 p.m.•66 views

CVE-2015-5041

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.

9.1CVSS8.7AI score0.01297EPSS

CVE•added 2021/07/30 12:15 p.m.•66 views

CVE-2021-29736

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300.

8.8CVSS8.5AI score0.00675EPSS

CVE•added 2021/09/16 4:15 p.m.•66 views

CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.

5.3CVSS5.3AI score0.00088EPSS

CVE•added 2019/09/30 4:15 p.m.•65 views

CVE-2019-4305

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.

5.3CVSS5.5AI score0.00255EPSS

CVE•added 2018/10/12 12:0 p.m.•64 views

CVE-2018-1770

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 148686.

6.5CVSS6.4AI score0.00513EPSS

CVE•added 2019/06/28 5:15 p.m.•64 views

CVE-2019-4269

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.

7.5CVSS7.1AI score0.00358EPSS

CVE•added 2018/03/22 12:29 p.m.•63 views

CVE-2017-1788

IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 137031.

5.3CVSS5.2AI score0.00486EPSS

CVE•added 2018/08/24 11:0 a.m.•63 views

CVE-2018-1755

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit acc...

5.9CVSS6AI score0.00401EPSS

CVE•added 2020/09/30 3:15 p.m.•63 views

CVE-2020-4629

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.

3.3CVSS3.4AI score0.00093EPSS

CVE•added 2016/11/24 7:59 p.m.•62 views

CVE-2016-0378

IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.

4.3CVSS5.2AI score0.00336EPSS

CVE•added 2020/05/06 2:15 p.m.•62 views

CVE-2020-4421

IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify. IBM X-Force ID: 180084.

5.5CVSS5.7AI score0.0017EPSS

CVE•added 2023/04/27 2:15 p.m.•62 views

CVE-2023-24966

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 24690...

6.1CVSS5.8AI score0.00127EPSS

CVE•added 2018/10/03 2:29 p.m.•61 views

CVE-2018-1794

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted ses...

6.1CVSS5.8AI score0.00346EPSS

CVE•added 2020/09/21 5:15 p.m.•61 views

CVE-2020-4643

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.

7.5CVSS7.5AI score0.00335EPSS

CVE•added 2018/05/24 9:29 p.m.•60 views

CVE-2013-3024

IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.

7.8CVSS7.6AI score0.00038EPSS

CVE•added 2017/07/24 9:29 p.m.•60 views

CVE-2017-1380

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

5.4CVSS5.3AI score0.00403EPSS

CVE•added 2018/11/16 4:0 p.m.•60 views

CVE-2018-1797

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit ...

6.3CVSS5.6AI score0.00607EPSS

CVE•added 2019/02/19 5:29 p.m.•60 views

CVE-2018-1996

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.

5.3CVSS5.2AI score0.00093EPSS

CVE•added 2020/10/28 5:15 p.m.•60 views

CVE-2020-4782

6.5CVSS6.4AI score0.00416EPSS

CVE•added 2022/09/28 4:15 p.m.•60 views

CVE-2022-35282

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.

6.5CVSS6.1AI score0.00031EPSS

CVE•added 2018/09/14 12:29 p.m.•59 views

CVE-2018-1719

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a downgrade of TLS protocol. A remote attacker could exploit this vulnerability to perform man-in-the-middle attacks. IBM X-Force ID: 147292.

5.9CVSS5.7AI score0.00279EPSS

CVE•added 2020/02/05 4:15 p.m.•59 views

CVE-2019-4670

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. IBM X-Force ID: 171319.

6.5CVSS6.2AI score0.00252EPSS

CVE•added 2020/09/10 5:15 p.m.•59 views

CVE-2020-4578

5.4CVSS5.3AI score0.00287EPSS

CVE•added 2017/07/21 8:29 p.m.•58 views

CVE-2017-1381

IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152.

3.3CVSS3.6AI score0.00057EPSS

CVE•added 2019/12/10 4:15 p.m.•58 views

CVE-2019-4663

IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.

5.4CVSS5.6AI score0.00218EPSS

CVE•added 2013/04/24 10:28 a.m.•57 views

CVE-2013-0542

Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.

4.3CVSS7.5AI score0.00266EPSS

CVE•added 2019/03/06 8:29 p.m.•57 views

CVE-2019-4030

5.4CVSS5.3AI score0.0024EPSS

CVE•added 2019/04/02 2:29 p.m.•57 views

CVE-2019-4080

IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing. A remote attacker could exploit this to consume all available CPU resources. IBM X-Force ID: 157380.

6.8CVSS6.4AI score0.0134EPSS

CVE•added 2021/04/21 12:15 p.m.•57 views

CVE-2021-20454

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.

8.2CVSS8AI score0.00172EPSS

CVE•added 2022/01/25 5:15 p.m.•57 views

CVE-2021-39031

IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM...

8.8CVSS8.4AI score0.00409EPSS

CVE•added 2020/05/14 4:15 p.m.•56 views

CVE-2020-4365

IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.

5.3CVSS4.4AI score0.00183EPSS

CVE•added 2020/10/01 4:15 p.m.•56 views

CVE-2020-4576

IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 184428.

7.5CVSS7.1AI score0.00442EPSS

CVE•added 2012/11/14 12:30 p.m.•55 views

CVE-2012-4851

Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

4.3CVSS7.3AI score0.0023EPSS

CVE•added 2018/12/12 4:29 p.m.•55 views

CVE-2018-1901

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.

8.8CVSS8.4AI score0.00739EPSS

CVE•added 2010/04/01 7:30 p.m.•54 views

CVE-2010-0769

IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 does not properly define wsadmin scripting J2CConnectionFactory objects, which allows local users to discover a KeyRingPassword password by reading a cleartext field in the resources.xml file.

1.9CVSS5.9AI score0.00054EPSS

CVE•added 2018/10/16 7:29 p.m.•54 views

CVE-2018-1777

5.4CVSS5.3AI score0.00315EPSS

CVE•added 2018/12/12 4:29 p.m.•54 views

CVE-2018-1926

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit...

8.8CVSS8.3AI score0.00181EPSS

CVE•added 2018/10/29 3:29 p.m.•53 views

CVE-2018-1767

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

6.1CVSS5.8AI score0.00373EPSS

CVE•added 2024/06/27 6:15 p.m.•53 views

CVE-2024-35153

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

4.8CVSS4.8AI score0.00151EPSS

CVE•added 2007/04/11 1:19 a.m.•51 views

CVE-2007-1944

The Java Message Service (JMS) in IBM WebSphere Application Server (WAS) before 6.1.0.7 allows attackers to cause a denial of service via unknown vectors involving the "double release [of] a bytebuffer input stream," possibly a double free vulnerability.

5CVSS6.3AI score0.00446EPSS

CVE•added 2011/03/08 9:59 p.m.•51 views

CVE-2011-1315

Memory leak in the messaging engine in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via network connections associated with a NULL return value from a synchronous JMS receive call.

5CVSS6.5AI score0.00808EPSS

Total number of security vulnerabilities167