WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4365 | 4.3 | May 14 | IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery Affected: 8.5.0.0 through 8.5.5.17 |
| CVE-2020-4329 | 4.3 | Apr 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.3; 17.0.0.3 through 20.0.0.4 |
| CVE-2019-4442 | 4.3 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.1 |
| CVE-2018-1902 | 4.3 | Mar 11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1743 | 4.3 | May 4 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1741 | 4.3 | Mar 14 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2016-0377 | 4.3 | Oct 22 | The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2026-11545 | 3.7 | Sep 18 | IBM WebSphere Application Server is affected by a privilege escalation Affected: 8.5; 9.0 |
| CVE-2016-0378 | 3.7 | Nov 24 | IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by… Affected: through 16.0.0.2 |
| CVE-2016-2960 | 3.7 | Aug 8 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2019-4271 | 3.5 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability Affected: 8.5.0.0 through 8.5.5.15; 9.0.0.0 through 9.0.0.11; 7.0.0.0 |
| CVE-2020-4629 | 3.3 | Sep 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message Affected: 7.0.0.0 through 7.0.0.45; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.18; 8.5.0.0 through 8.5.5.18; +2 more |
| CVE-2017-1381 | 3.3 | Jul 21 | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data… Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.13; 8.5.0.0 through 8.5.5.12; 9.0.0.0 through 9.0.0.4 |
| CVE-2026-16190 | 3.1 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2016-0385 | 3.1 | Sep 1 | Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2025-27907 | 2.7 | Apr 22 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF) Affected: 8.5 before 8.5.5.28; 9.0 before 9.0.5.24 |
| CVE-2015-5004 | – | Dec 15 | The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +17 more |
| CVE-2015-2017 | – | Nov 8 | CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2015-4938 | – | Aug 22 | IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information… Affected: 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; 7.0.0.6; +34 more |
| CVE-2015-1932 | – | Aug 22 | IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to… Affected: 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; 7.0.0.6; +34 more |
| CVE-2015-1946 | – | Jul 14 | IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server (WAS) 7.0 and 8.0, does not… Affected: 7.0; 8.0.0.0; 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; +5 more |
| CVE-2015-1936 | – | Jul 14 | The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +14 more |
| CVE-2015-1927 | – | Jul 14 | The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2015-1920 | – | May 20 | IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2015-1885 | – | Apr 27 | WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6,… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.10; 7.0.0.11; +31 more |
| CVE-2015-1882 | – | Apr 27 | Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +2 more |
| CVE-2015-0175 | – | Apr 27 | IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +2 more |
| CVE-2015-0174 | – | Apr 27 | The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +2 more |
| CVE-2015-0106 | – | Mar 24 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and… Affected: 7.1; 7.2; 7.2.0.1; 7.2.0.2; 7.2.0.3; 7.2.0.4; +1 more |
| CVE-2014-8890 | – | Dec 18 | IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +1 more |
| CVE-2014-6174 | – | Dec 18 | IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web… Affected: 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; 7.0.0.6; +34 more |
| CVE-2014-6167 | – | Dec 18 | Cross-site scripting (XSS) vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4… Affected: 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; 7.0.0.6; +34 more |
| CVE-2014-6166 | – | Dec 18 | The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +11 more |
| CVE-2014-6164 | – | Dec 18 | IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +11 more |
| CVE-2014-3021 | – | Oct 19 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2014-4816 | – | Sep 23 | Cross-site request forgery (CSRF) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2014-4770 | – | Sep 23 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2014-4758 | – | Sep 4 | IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send… Affected: 7.2; 7.2.0.1; 7.2.0.2; 7.2.0.3; 7.2.0.4; 7.2.0.5 |
| CVE-2014-3075 | – | Sep 4 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to… Affected: 7.2; 7.2.0.1; 7.2.0.2; 7.2.0.3; 7.2.0.4; 7.2.0.5 |
| CVE-2014-4767 | – | Aug 22 | IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2 |
| CVE-2014-4764 | – | Aug 22 | IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3, when Load Balancer for IPv4 Dispatcher is enabled, allows remote attackers to cause a denial… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +10 more |
| CVE-2014-3083 | – | Aug 22 | IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +34 more |
| CVE-2014-3070 | – | Aug 22 | The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +10 more |
| CVE-2014-3022 | – | Aug 22 | IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +31 more |
| CVE-2014-0965 | – | Aug 22 | IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +31 more |
| CVE-2014-3087 | – | Aug 17 | callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files… Affected: 7.2 |
| CVE-2014-0957 | – | Jul 18 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager 7.5 through 8.5.5, and WebSphere Lombardi Edition 7.2, allows remote attackers to inject arbitrary web… Affected: 7.2 |
| CVE-2014-0891 | – | Jun 28 | IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2014-0964 | – | May 16 | IBM WebSphere Application Server (WAS) 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of service via crafted TLS traffic, as… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2014-0896 | – | May 1 | IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1 |
The 500 most important CVEs for this product (exploited first, then by severity)