WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-0707 | – | Feb 23 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach… Affected: 7.2 |
| CVE-2012-0193 | – | Jan 20 | IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without… Affected: 6.0.0.0; 6.0.0.2; 6.0.0.3; 6.0.1.0; 6.0.1.11; 6.0.1.12; +34 more |
| CVE-2011-1376 | – | Jan 19 | iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under… Affected: 6.1; 6.1.0.1; 6.1.0.3; 6.1.0.5; 6.1.0.7; 6.1.0.9; +29 more |
| CVE-2011-5066 | – | Jan 15 | The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2011-5065 | – | Jan 15 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2011-1377 | – | Jan 15 | The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2011-1362 | – | Jan 15 | Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2009-2748 | – | Oct 30 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.5; 6.1.0.7; +17 more |
| CVE-2009-2747 | – | Oct 30 | The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2011-1368 | – | Oct 29 | The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to… Affected: 8.0.0.0 |
| CVE-2011-1359 | – | Sep 6 | Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2011-1356 | – | Jul 19 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows local users to obtain sensitive stack-trace information via a crafted Administration… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2011-1355 | – | Jul 19 | Open redirect vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2010-3271 | – | Jul 18 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1209 | – | May 4 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +34 more |
| CVE-2011-1683 | – | Apr 13 | IBM WebSphere Application Server (WAS) 6.0.x through 6.0.2.43, 6.1.x before 6.1.0.37, and 7.0.x before 7.0.0.17 on z/OS, when a Local OS user registry or Federated Repository with… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2011-1322 | – | Mar 8 | The SOAP with Attachments API for Java (SAAJ) implementation in the Web Services component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +27 more |
| CVE-2011-1321 | – | Mar 8 | The AuthCache purge implementation in the Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +27 more |
| CVE-2011-1320 | – | Mar 8 | The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when the Tivoli Integrated Portal / embedded WebSphere… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +26 more |
| CVE-2011-1319 | – | Mar 8 | The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote authenticated users to cause a denial of service… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +26 more |
| CVE-2011-1318 | – | Mar 8 | Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1317 | – | Mar 8 | Memory leak in com.ibm.ws.jsp.runtime.WASJSPStrBufferImpl in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +27 more |
| CVE-2011-1316 | – | Mar 8 | The Session Initiation Protocol (SIP) Proxy in the HTTP Transport component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1315 | – | Mar 8 | Memory leak in the messaging engine in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via network… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1314 | – | Mar 8 | The Service Integration Bus (SIB) messaging engine in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (daemon hang) by… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1313 | – | Mar 8 | Double free vulnerability in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote backend IIOP servers to cause a denial of service… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +26 more |
| CVE-2011-1312 | – | Mar 8 | The Administrative Console component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +24 more |
| CVE-2011-1311 | – | Mar 8 | The Security component in IBM WebSphere Application Server (WAS) before 7.0.0.15, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1310 | – | Mar 8 | The Administrative Scripting Tools component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when tracing is enabled, places wsadmin… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +26 more |
| CVE-2011-1309 | – | Mar 8 | The Plug-in component in IBM WebSphere Application Server (WAS) before 7.0.0.15 does not properly handle trace requests, which has unspecified impact and attack vectors Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1308 | – | Mar 8 | Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) before 7.0.0.15… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2011-1307 | – | Mar 8 | The installer in IBM WebSphere Application Server (WAS) before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to… Affected: through 7.0.0.13; 2.0; 3.0; 3.0.2; 3.0.2.1; 3.0.2.2; +34 more |
| CVE-2008-7274 | – | Feb 14 | IBM WebSphere Application Server (WAS) 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by (1) not… Affected: 6.1.0.9 |
| CVE-2011-0316 | – | Jan 12 | The Administrative Console component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets,… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +28 more |
| CVE-2011-0315 | – | Jan 12 | Cross-site scripting (XSS) vulnerability in the Servlet Engine / Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +28 more |
| CVE-2010-4220 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +7 more |
| CVE-2010-0786 | – | Nov 9 | The Web Services Security component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 does not properly implement the Java API for XML Web Services (aka JAX-WS), which… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +7 more |
| CVE-2010-0785 | – | Nov 9 | Cross-site request forgery (CSRF) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +27 more |
| CVE-2010-0784 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +7 more |
| CVE-2010-0783 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2010-3700 | – | Oct 29 | VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0,… Affected: 6.1; 7.0 |
| CVE-2010-0781 | – | Sep 21 | Unspecified vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 allows remote authenticated users to cause a denial of… Affected: 6.1.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +12 more |
| CVE-2010-3186 | – | Aug 30 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is… Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +27 more |
| CVE-2010-0779 | – | Jun 24 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2010-0778 | – | Jun 24 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +20 more |
| CVE-2010-2328 | – | Jun 18 | The HTTP Channel in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (NullPointerException) via a large amount of… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.5; 7.0.0.7; 7.0.0.9 |
| CVE-2010-2327 | – | Jun 18 | mod_ibm_ssl in IBM HTTP Server 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11, as used in IBM WebSphere Application Server (WAS) on z/OS, does not properly… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.2; +34 more |
| CVE-2010-2326 | – | Jun 18 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.5; 7.0.0.7; 7.0.0.9 |
| CVE-2010-2325 | – | Jun 18 | Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows remote attackers to inject… Affected: through 7.0.0.10; 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +5 more |
| CVE-2010-2324 | – | Jun 18 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows attackers to perform unspecified "link injection" actions via unknown vectors Affected: through 7.0.0.10; 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +5 more |
The 500 most important CVEs for this product (exploited first, then by severity)