WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-0434 | – | Feb 10 | PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2009-0433 | – | Feb 10 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content… Affected: 5.1.0; 5.1.0.2; 5.1.0.3; 5.1.0.4; 5.1.0.5; 5.1.1; +34 more |
| CVE-2009-0432 | – | Feb 10 | The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not… Affected: 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; 6.1.0.9; +4 more |
| CVE-2008-4284 | – | Feb 10 | Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before… Affected: 5.0; 5.0; 5.0.0; 5.0.1; 5.0.2; 5.0.2.1; +34 more |
| CVE-2008-4283 | – | Feb 10 | CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject… Affected: through 5.1.1.19; 5.0; 5.0; 5.0.0; 5.0.1; 5.0.2; +34 more |
| CVE-2009-0391 | – | Feb 2 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors Affected: 6.0.1 |
| CVE-2008-5414 | – | Dec 10 | Unspecified vulnerability in the Feature Pack for Web Services in the Web Services Security component in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 has unknown impact… Affected: 7.0 |
| CVE-2008-5413 | – | Dec 10 | PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 allows attackers to obtain sensitive information by reading the (1)… Affected: through 7.0 |
| CVE-2008-5412 | – | Dec 10 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows has unknown impact and attack vectors related to JSPs Affected: through 7.0 |
| CVE-2008-5411 | – | Dec 10 | IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 sends SSL traffic over "unsecured TCP," which makes it easier for remote attackers to obtain sensitive information by… Affected: through 7.0 |
| CVE-2008-4679 | – | Oct 22 | The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to… Affected: 6.0.1.1; 6.0.1.2; 6.0.1.3; 6.0.1.5; 6.0.1.7; 6.0.1.9; +20 more |
| CVE-2008-4678 | – | Oct 22 | The HTTP_Request_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service… Affected: 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; 6.0.2.5; +10 more |
| CVE-2008-4111 | – | Sep 16 | Unspecified vulnerability in Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when the FileServing feature is… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +15 more |
| CVE-2008-3236 | – | Jul 21 | Unspecified vulnerability in Wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 5.1 before 5.1.1.19 allows attackers to obtain… Affected: 5.1.0; 5.1.1; 5.1.1.1; 5.1.1.2; 5.1.1.3; 5.1.1.4; +14 more |
| CVE-2008-3235 | – | Jul 21 | Unspecified vulnerability in the PropFilePasswordEncoder utility in the Security component in IBM WebSphere Application Server (WAS) 5.1 before 5.1.1.19 has unknown impact and… Affected: 5.1.0; 5.1.1; 5.1.1.1; 5.1.1.2; 5.1.1.3; 5.1.1.4; +14 more |
| CVE-2008-2550 | – | Jun 4 | Unspecified vulnerability in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.17 has unknown impact and attack vectors related to an… Affected: through 6.1.0.16; 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; +13 more |
| CVE-2008-2221 | – | May 14 | Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors Affected: 5.0.2 |
| CVE-2008-0741 | – | Feb 13 | Unspecified vulnerability in the PropFilePasswordEncoder utility in IBM WebSphere Application Server (WAS) before 6.0.2 Fix Pack 25 (6.0.2.25) has unknown impact and attack… Affected: through 6.0.2.24 |
| CVE-2008-0740 | – | Feb 13 | IBM WebSphere Application Server (WAS) before 6.0.2 Fix Pack 25 (6.0.2.25) and 6.1 before Fix Pack 15 (6.1.0.15) writes unspecified cleartext information to http_plugin.log, which… Affected: through 6.0.2.24 |
| CVE-2008-0389 | – | Jan 23 | Unspecified vulnerability in the serveServletsByClassnameEnabled feature in IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.25, 6.1 through 6.1.0.14, and 5.1.1.x before… Affected: through 5.1.1.17; 5.1.1; 5.1.1.1; 5.1.1.2; 5.1.1.3; 5.1.1.4; +34 more |
| CVE-2007-6679 | – | Jan 10 | Unspecified vulnerability in the Administrative Console in IBM WebSphere Application Server 6.1 before Fix Pack 13 has unknown impact and attack vectors, related to "security… Affected: through 6.0.2.24; 6.1; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +3 more |
| CVE-2007-5944 | – | Nov 14 | Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject… Affected: 5.1.1.4; 5.1.1.5; 5.1.1.6; 5.1.1.7; 5.1.1.8; 5.1.1.9; +7 more |
| CVE-2007-5799 | – | Nov 3 | Multiple cross-site request forgery (CSRF) vulnerabilities in uddigui/navigateTree.do in the UDDI user console in IBM WebSphere Application Server (WAS) before 6.1.0 Fix Pack 13… Affected: through 6.1.0.12 |
| CVE-2007-5798 | – | Nov 3 | Multiple cross-site scripting (XSS) vulnerabilities in uddigui/navigateTree.do in the UDDI user console in IBM WebSphere Application Server (WAS) before 6.1.0 Fix Pack 13… Affected: through 6.1.0.12 |
| CVE-2007-5483 | – | Oct 16 | Unspecified vulnerability in the Administrative Scripting Tools (such as wsadmin or ANT) in IBM WebSphere Application Server 5.x and 6.0.x has unknown impact and attack vectors Affected: 5.1.1; 5.1.1.1; 5.1.1.2; 5.1.1.3; 5.1.1.4; 5.1.1.5; +27 more |
| CVE-2007-4839 | – | Sep 12 | Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown impact and attack vectors, aka PK33803 Affected: 6.1.0.9 |
| CVE-2007-4833 | – | Sep 12 | Unspecified vulnerability in the Edge Component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown impact and attack vectors, aka PK44789 Affected: through 6.1.0.9 |
| CVE-2007-3960 | – | Jul 24 | Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK33799, or (2) a… Affected: through 6.0.2.19 |
| CVE-2007-3397 | – | Jun 26 | The web container in IBM WebSphere Application Server (WAS) before 6.0.2.21, and 6.1.x before 6.1.0.9, sends response data intended for a different request in certain… Affected: 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; 6.0.2.5; +14 more |
| CVE-2007-3265 | – | Jun 19 | Cross-site scripting (XSS) vulnerability in the Samples component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier allows remote attackers to inject arbitrary web… Affected: through 6.1.0.7 |
| CVE-2007-3264 | – | Jun 19 | Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors Affected: through 6.1.0.7 |
| CVE-2007-3263 | – | Jun 19 | Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors, related to… Affected: through 6.1.0.7 |
| CVE-2007-3262 | – | Jun 19 | Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier allows remote attackers to cause a denial of service… Affected: through 6.1.0.7 |
| CVE-2006-7198 | – | Apr 30 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a… Affected: 5.1.1.14; through 6.0.2.11 |
| CVE-2007-1945 | – | Apr 11 | Unspecified vulnerability in the Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) before 6.1.0.7 has unknown impact and attack vectors Affected: through 6.1.0.1 |
| CVE-2007-1944 | – | Apr 11 | The Java Message Service (JMS) in IBM WebSphere Application Server (WAS) before 6.1.0.7 allows attackers to cause a denial of service via unknown vectors involving the "double… Affected: through 6.1.0.1 |
| CVE-2007-1608 | – | Mar 22 | CRLF injection vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.19 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting… Affected: through 6.0.2.15 |
| CVE-2006-7166 | – | Mar 20 | IBM WebSphere Application Server (WAS) 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL." Affected: 5.0; 5.0.1; 5.0.2; 5.0.2.1; 5.0.2.2; 5.0.2.3; +28 more |
| CVE-2006-7165 | – | Mar 20 | IBM WebSphere Application Server (WAS) 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs." Affected: 5.1.0; 5.1.0.2; 5.1.0.3; 5.1.0.4; 5.1.0.5; 5.1.1 |
| CVE-2006-7164 | – | Mar 20 | SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which… Affected: 5.0.1; 5.0.2; 5.0.2.1; 5.0.2.2; 5.0.2.3; 5.0.2.4; +12 more |
| CVE-2006-6637 | – | Dec 19 | The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is… Affected: 6.0.2.1; 6.0.2.3; 6.0.2.5; 6.0.2.7; 6.0.2.9; 6.0.2.11; +2 more |
| CVE-2006-6636 | – | Dec 19 | Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server (WAS) before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors Affected: 5.1.1; 5.1.1.1; 5.1.1.2; 5.1.1.3; 5.1.1.4; 5.1.1.5; +14 more |
| CVE-2006-6136 | – | Nov 28 | IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) does not perform EAL4 authentication checks at the proper time during "registering of response operation," which… Affected: 6.1.0 |
| CVE-2006-6135 | – | Nov 28 | Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) have unknown impact and attack vectors, related to (1) a "Potential… Affected: 6.1.0 |
| CVE-2006-5324 | – | Oct 17 | The Web Services Notification (WSN) security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a… Affected: through 6.1.0.1 |
| CVE-2006-5323 | – | Oct 17 | Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360 Affected: through 6.1.0.1 |
| CVE-2006-4223 | – | Aug 18 | IBM WebSphere Application Server (WAS) before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code… Affected: through 6.0.2.11; 6.0.2; 6.0.2.1; 6.0.2.3; 6.0.2.5; 6.0.2.7; +1 more |
| CVE-2006-4222 | – | Aug 18 | Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including (1) an "authority problem" in… Affected: through 6.0.2.11; 6.0.2; 6.0.2.1; 6.0.2.3; 6.0.2.5; 6.0.2.7; +1 more |
| CVE-2006-4137 | – | Aug 14 | IBM WebSphere Application Server before 6.1.0.1 allows attackers to obtain sensitive information via unspecified vectors related to (1) the log file, (2) "script generated syntax… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.2; +10 more |
| CVE-2006-4136 | – | Aug 14 | Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.1.0.1 have unspecified impact and attack vectors involving (1) "SOAP requests and responses", (2)… Affected: through 6.1.0.0; 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; +10 more |
The 500 most important CVEs for this product (exploited first, then by severity)