WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-0859 | – | May 1 | The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +34 more |
| CVE-2014-0857 | – | May 1 | The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 7.0; +9 more |
| CVE-2014-0823 | – | May 1 | IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 7.0; +9 more |
| CVE-2013-6323 | – | May 1 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2,… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2013-6725 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2… Affected: 6.1; 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2013-6330 | – | Jan 16 | IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.10; 7.0.0.11; +16 more |
| CVE-2013-6325 | – | Jan 16 | IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption)… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +34 more |
| CVE-2013-5418 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +33 more |
| CVE-2013-5417 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote attackers to… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +33 more |
| CVE-2013-5414 | – | Nov 18 | The migration functionality in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 does not properly support the distinction… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +33 more |
| CVE-2013-4006 | – | Nov 18 | IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0 |
| CVE-2013-4053 | – | Sep 20 | The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 7.0; 7.0.0.1; +34 more |
| CVE-2013-4052 | – | Sep 20 | Cross-site scripting (XSS) vulnerability in the UDDI Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8,… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2013-0596 | – | Sep 20 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 allows remote attackers to inject arbitrary… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +23 more |
| CVE-2013-4005 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2013-4004 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +4 more |
| CVE-2013-3029 | – | Aug 21 | Cross-site request forgery (CSRF) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +34 more |
| CVE-2013-2976 | – | Aug 21 | The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +34 more |
| CVE-2013-2967 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2013-0597 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows… Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.0.0.0; 8.0.0.1; 8.0.0.2; +30 more |
| CVE-2013-1777 | – | Jul 11 | The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not… Affected: 3.0.0.3 |
| CVE-2013-0482 | – | May 29 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +28 more |
| CVE-2013-0565 | – | Apr 24 | Cross-site scripting (XSS) vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server (WAS) 8.5 before 8.5.0.2 allows remote attackers… Affected: 8.5.0.0; 8.5.0.1 |
| CVE-2013-0544 | – | Apr 24 | Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0543 | – | Apr 24 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0542 | – | Apr 24 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and… Affected: through 6.1.0.45; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2013-0541 | – | Apr 24 | Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0540 | – | Apr 24 | IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote… Affected: 8.5.0.0; 8.5.0.1 |
| CVE-2013-0462 | – | Jan 27 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.5; 7.0.0.7; +12 more |
| CVE-2013-0461 | – | Jan 27 | Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0460 | – | Jan 27 | Cross-site request forgery (CSRF) vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 and 7.0 before… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0459 | – | Jan 27 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2013-0458 | – | Jan 27 | Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and… Affected: 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +34 more |
| CVE-2012-5955 | – | Dec 20 | Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown… Affected: All versions, or not specified |
| CVE-2012-4853 | – | Nov 14 | Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2012-4851 | – | Nov 14 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 8.5.0.0 |
| CVE-2012-4850 | – | Nov 14 | IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via… Affected: 8.5.0.0 |
| CVE-2012-3330 | – | Nov 14 | The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual Enterprise, allows remote attackers to… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +18 more |
| CVE-2012-3311 | – | Sep 25 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +34 more |
| CVE-2012-3306 | – | Sep 25 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +34 more |
| CVE-2012-3305 | – | Sep 25 | Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2012-3304 | – | Sep 25 | The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +34 more |
| CVE-2012-3325 | – | Aug 30 | IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2012-3293 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +34 more |
| CVE-2012-2190 | – | Aug 21 | IBM Global Security Kit (aka GSKit), as used in IBM HTTP Server in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +34 more |
| CVE-2012-2170 | – | Jun 20 | The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +10 more |
| CVE-2012-0720 | – | Jun 20 | Cross-site scripting (XSS) vulnerability in the Integration Solution Console in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +10 more |
| CVE-2012-0717 | – | Jun 20 | IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +10 more |
| CVE-2012-0716 | – | Jun 20 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +10 more |
| CVE-2012-2162 | – | May 1 | The Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows… Affected: through 8.0.0.0; 5.0; 5.0.0; 5.0.1; 5.0.2; 5.0.2.1; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)