Websphere Application Server@8.5.0.0 Security Vulnerabilities and Issues — Page 2 of Websphere Application Server@8.5.0.0 CVE List

Lucene search

IbmWebsphere Application Server8.5.0.0

80 matches found

CVE•added 2014/05/01 5:29 p.m.•55 views

CVE-2014-0857

The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.

4CVSS8.3AI score0.00253EPSS

CVE•added 2014/06/28 12:55 a.m.•55 views

CVE-2014-0891

IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Proxy or (2) ODR server.

5CVSS8.9AI score0.0039EPSS

CVE•added 2016/01/23 5:59 a.m.•55 views

CVE-2015-7417

Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.

5.4CVSS5.1AI score0.00172EPSS

CVE•added 2012/09/25 8:55 p.m.•54 views

CVE-2012-3304

The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors.

6.8CVSS9AI score0.00731EPSS

CVE•added 2014/01/16 8:55 p.m.•54 views

CVE-2013-6325

IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption) via a crafted request to a web services endpoint.

4.3CVSS8.7AI score0.00923EPSS

CVE•added 2014/08/22 1:55 a.m.•54 views

CVE-2014-0965

IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

4.3CVSS8.6AI score0.00549EPSS

CVE•added 2013/01/27 6:55 p.m.•53 views

CVE-2013-0458

Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via ...

4.3CVSS7.4AI score0.00266EPSS

CVE•added 2013/08/21 9:55 p.m.•53 views

CVE-2013-2967

Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS6.9AI score0.00165EPSS

CVE•added 2015/04/27 12:59 p.m.•53 views

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

8.5CVSS9.2AI score0.00952EPSS

CVE•added 2018/07/06 2:29 p.m.•53 views

CVE-2018-1621

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346.

6.7CVSS6.3AI score0.00054EPSS

CVE•added 2012/08/21 10:46 a.m.•52 views

CVE-2012-3293

Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME el...

4.3CVSS7.3AI score0.00328EPSS

CVE•added 2012/09/25 8:55 p.m.•52 views

CVE-2012-3306

IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors.

6.8CVSS9.4AI score0.00343EPSS

CVE•added 2013/11/18 5:23 a.m.•52 views

CVE-2013-4006

IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.

4.3CVSS8.2AI score0.00179EPSS

CVE•added 2014/05/01 5:29 p.m.•52 views

CVE-2014-0859

The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

5CVSS8.8AI score0.01888EPSS

CVE•added 2013/01/27 6:55 p.m.•51 views

CVE-2013-0461

Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspe...

4.3CVSS7.3AI score0.00266EPSS

CVE•added 2013/05/29 2:29 p.m.•51 views

CVE-2013-0482

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, r...

4.3CVSS7.7AI score0.01374EPSS

CVE•added 2013/04/24 10:28 a.m.•51 views

CVE-2013-0543

IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions ...

6.8CVSS9AI score0.00345EPSS

CVE•added 2013/04/24 10:28 a.m.•51 views

CVE-2013-0544

Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.

4CVSS8.5AI score0.00457EPSS

CVE•added 2015/04/27 12:59 p.m.•51 views

CVE-2015-0175

IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

5.5CVSS8.8AI score0.0049EPSS

CVE•added 2013/08/21 9:55 p.m.•50 views

CVE-2013-0597

Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

3.5CVSS6.6AI score0.00162EPSS

CVE•added 2013/08/21 9:55 p.m.•50 views

CVE-2013-2976

The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors.

1.9CVSS7.4AI score0.00054EPSS

CVE•added 2013/11/18 5:23 a.m.•50 views

CVE-2013-5418

Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

3.5CVSS7AI score0.00162EPSS

CVE•added 2015/07/14 5:59 p.m.•50 views

CVE-2015-1936

The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.

6CVSS7.2AI score0.00311EPSS

CVE•added 2013/04/24 10:28 a.m.•49 views

CVE-2013-0541

Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger (WIM), allows local users to cause a denial of service (daemon cra...

1.9CVSS8.3AI score0.00054EPSS

CVE•added 2013/08/21 9:55 p.m.•49 views

CVE-2013-4005

Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields.

3.5CVSS7AI score0.00162EPSS

CVE•added 2015/04/27 12:59 p.m.•48 views

CVE-2015-0174

The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

4CVSS8.3AI score0.00267EPSS

CVE•added 2014/05/01 5:29 p.m.•45 views

CVE-2014-0896

IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request.

4.3CVSS8.7AI score0.00234EPSS

CVE•added 2014/08/22 1:55 a.m.•44 views

CVE-2014-4767

IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

6.5CVSS9.2AI score0.01349EPSS

CVE•added 2015/12/15 5:59 a.m.•39 views

CVE-2015-5004

The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

4CVSS5.6AI score0.00165EPSS

CVE•added 2018/10/12 5:29 a.m.•32 views

CVE-2018-1838

IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of passwords. IBM X-Force ID: 150811.

6.5CVSS6.7AI score0.00129EPSS

Total number of security vulnerabilities80