WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5016 | 6.5 | Mar 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.6 |
| CVE-2020-4782 | 6.5 | Oct 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.18; 9.0.0.0 through 9.0.5.5 |
| CVE-2020-4590 | 6.5 | Sep 21 | IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack… Affected: 17.0.0.3 through 20.0.0.9 |
| CVE-2019-4670 | 6.5 | Feb 5 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.2 |
| CVE-2019-4732 | 6.5 | Feb 3 | IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2019-4477 | 6.5 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2019-4080 | 6.5 | Apr 2 | IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.15; 9.0.0.0 through 9.0.0.10 |
| CVE-2018-1770 | 6.5 | Oct 12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1838 | 6.5 | Oct 12 | IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of passwords Affected: 8.5.0.0; 9.0.0.0 |
| CVE-2015-0110 | 6.5 | Sep 15 | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access… Affected: 7.2.0.0; 7.2.0.1; 7.2.0.2; 7.2.0.3; 7.2.0.4; 7.2.0.5 |
| CVE-2017-1504 | 6.5 | Aug 3 | IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption Affected: 9.0.0.4 |
| CVE-2026-16185 | 6.4 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2023-27554 | 6.3 | May 11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 8.5.0.0 before 8.5.5.24; 9.0.0.0 before 9.0.5.16 |
| CVE-2019-4304 | 6.3 | Sep 30 | IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation Affected: before 19.0.0.10 |
| CVE-2026-14515 | 6.1 | Jul 28 | IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities Affected: 8.5; 9.0 |
| CVE-2026-11594 | 6.1 | Jun 30 | IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities Affected: 9.0; 8.5 |
| CVE-2024-27270 | 6.1 | Mar 27 | IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting Affected: 23.0.0.3 before 24.0.0.4 |
| CVE-2023-24966 | 6.1 | Apr 27 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5.0.0 before 8.5.5.24; 9.0.0.0 before 9.0.5.16 |
| CVE-2022-22477 | 6.1 | Jul 14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2020-4575 | 6.1 | Aug 27 | IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager… Affected: 8.5.0.0 before 8.5.5.18; 9.0.0.0 before 9.0.5.5 |
| CVE-2020-4304 | 6.1 | Apr 2 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting Affected: 17.0.0.3 through 20.0.0.3 |
| CVE-2020-4303 | 6.1 | Apr 2 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting Affected: 17.0.0.3 through 20.0.0.3 |
| CVE-2018-1643 | 6.1 | Nov 15 | The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.13; 9.0.0.0 through 9.0.0.8 |
| CVE-2018-1798 | 6.1 | Nov 12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1767 | 6.1 | Oct 29 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1794 | 6.1 | Oct 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1793 | 6.1 | Oct 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1503 | 6.1 | Oct 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2016-0359 | 6.1 | Jul 3 | CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2016-0283 | 6.1 | Mar 19 | Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 before 8.5.5.9 allows… Affected: 8.5.5.0; 8.5.5.1; 8.5.5.2; 8.5.5.3; 8.5.5.4; 8.5.5.5; +3 more |
| CVE-2026-16435 | 5.9 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-5516 | 5.9 | May 27 | IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability Affected: 22.0.0.11 through 26.0.0.5 |
| CVE-2026-3621 | 5.9 | Apr 22 | IBM WebSphere Application Server Liberty is affected by identity spoofing Affected: 17.0.0.3 before 26.0.0.5 |
| CVE-2023-50315 | 5.9 | Aug 14 | IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks Affected: 8.5.0.0; 9.0.0.0 |
| CVE-2022-38712 | 5.9 | Nov 3 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized… Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.23; 9.0.0.0 before 9.0.5.14 |
| CVE-2022-22365 | 5.9 | May 20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.21; 9.0.0.0 through 9.0.5.11 |
| CVE-2018-1719 | 5.9 | Sep 14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.8 |
| CVE-2018-1755 | 5.9 | Aug 24 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use… Affected: All versions, or not specified |
| CVE-2017-1501 | 5.9 | Aug 18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services security bindings settings Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +15 more |
| CVE-2016-0306 | 5.9 | May 17 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2018-1695 | 5.6 | Sep 6 | IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks Affected: 7.0.0.0; 8.0.0.0; 8.5.5.0 |
| CVE-2024-45086 | 5.5 | Nov 4 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data Affected: 8.5.0.0 before 8.5.5.27; 9.0.0.0 before 9.0.5.22 |
| CVE-2024-45072 | 5.5 | Oct 16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 8.5.0.0 through 8.5.5.26; 9.0.0.0 through 9.0.5.21 |
| CVE-2023-35890 | 5.5 | Jul 7 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file Affected: 8.5.5.23; 9.0.5.15; 9.0.5.16 |
| CVE-2018-1957 | 5.5 | Dec 10 | IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the… Affected: 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1797 | 5.5 | Nov 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2026-15887 | 5.4 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-16186 | 5.4 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11383 | 5.4 | Jul 30 | Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager Affected: 8.5 before 8.5.5.30; 9.0 before 9.0.5.29 |
| CVE-2026-1561 | 5.4 | Mar 25 | IBM WebSphere Application Server Liberty Server-Side Request Forgery Affected: 17.0.0.3 through 26.0.0.3 |
The 500 most important CVEs for this product (exploited first, then by severity)