WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-38712 | 5.9 | Nov 3 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized… Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.23; 9.0.0.0 before 9.0.5.14 |
| CVE-2022-22365 | 5.9 | May 20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.21; 9.0.0.0 through 9.0.5.11 |
| CVE-2018-1719 | 5.9 | Sep 14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.8 |
| CVE-2018-1755 | 5.9 | Aug 24 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use… Affected: All versions, or not specified |
| CVE-2017-1501 | 5.9 | Aug 18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services security bindings settings Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +15 more |
| CVE-2016-0306 | 5.9 | May 17 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2018-1695 | 5.6 | Sep 6 | IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks Affected: 7.0.0.0; 8.0.0.0; 8.5.5.0 |
| CVE-2024-45086 | 5.5 | Nov 4 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data Affected: 8.5.0.0 before 8.5.5.27; 9.0.0.0 before 9.0.5.22 |
| CVE-2024-45072 | 5.5 | Oct 16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 8.5.0.0 through 8.5.5.26; 9.0.0.0 through 9.0.5.21 |
| CVE-2023-35890 | 5.5 | Jul 7 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file Affected: 8.5.5.23; 9.0.5.15; 9.0.5.16 |
| CVE-2018-1957 | 5.5 | Dec 10 | IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the… Affected: 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1797 | 5.5 | Nov 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2026-15887 | 5.4 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-16186 | 5.4 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11383 | 5.4 | Jul 30 | Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager Affected: 8.5 before 8.5.5.30; 9.0 before 9.0.5.29 |
| CVE-2026-1561 | 5.4 | Mar 25 | IBM WebSphere Application Server Liberty Server-Side Request Forgery Affected: 17.0.0.3 through 26.0.0.3 |
| CVE-2025-12635 | 5.4 | Dec 8 | IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting Affected: 9.0 through 2.0.18; 8.5 |
| CVE-2023-26283 | 5.4 | Apr 2 | IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting Affected: 9.0 |
| CVE-2022-40750 | 5.4 | Nov 11 | IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2022-34336 | 5.4 | Sep 13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2022-34165 | 5.4 | Sep 9 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.22; 9.0.0.0 through 9.0.5.13; 17.0.0.3 before 22.0.0.9 |
| CVE-2021-39038 | 5.4 | Feb 24 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the… Affected: 9.0.0.0 before 9.0.5.12; 17.0.0.3 through 22.0.0.2 |
| CVE-2020-4578 | 5.4 | Sep 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.5 |
| CVE-2020-4421 | 5.4 | May 6 | IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify Affected: 19.0.0.5 before 20.0.0.5 |
| CVE-2019-4663 | 5.4 | Dec 10 | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting Affected: 17.0.0.3 before 19.0.0.11 |
| CVE-2019-4270 | 5.4 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2019-4285 | 5.4 | Jul 30 | IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim Affected: All versions, or not specified |
| CVE-2019-4030 | 5.4 | Mar 6 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2018-1777 | 5.4 | Oct 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1380 | 5.4 | Jul 24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.13; 8.5.0.0 through 8.5.5.11; 9.0.0.0 through 9.0.0.4 |
| CVE-2017-1121 | 5.4 | Feb 13 | IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting Affected: 7.0; 8.0; 8.5; 8.5.5; 9.0 |
| CVE-2016-8934 | 5.4 | Feb 1 | IBM WebSphere Application Server is vulnerable to cross-site scripting Affected: 8.5.5.0; 8.5.5.0; 8.5.5.1; 8.5.5.1; 8.5.5.2; 8.5.5.2; +16 more |
| CVE-2016-3042 | 5.4 | Oct 1 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2015-7417 | 5.4 | Jan 23 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2026-11540 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11539 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11538 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-16188 | 5.3 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9667 | 5.3 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9338 | 5.3 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-10571 | 5.3 | Aug 13 | IBM WebSphere Application Server Liberty is affected by a denial of service Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2022-39161 | 5.3 | May 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2022-22473 | 5.3 | Jul 14 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.21; 9.0.0.0 through 9.0.5.12 |
| CVE-2021-29842 | 5.3 | Sep 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5 through 8.5.5.20; 9.0.0.0 through 9.0.5.9; 17.0.0.3 through 21.0.0.9 |
| CVE-2020-10693 | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final Affected: 17.0.0.3 through 20.0.0.10 |
| CVE-2019-4441 | 5.3 | Oct 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.1; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; +3 more |
| CVE-2019-4305 | 5.3 | Sep 30 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie Affected: before 19.0.0.10 |
| CVE-2019-4505 | 5.3 | Sep 20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL Affected: 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2019-4268 | 5.3 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2018-1996 | 5.3 | Feb 19 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration Affected: 7.0; 8.0; 8.5; 9.0 |
The 500 most important CVEs for this product (exploited first, then by severity)