WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-2323 | – | Jun 18 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated… Affected: through 7.0.0.10; 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +5 more |
| CVE-2010-0777 | – | May 17 | The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle long filenames and… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2010-0776 | – | May 17 | The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle chunked transfer encoding… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2010-0775 | – | May 17 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 allows remote attackers to cause a denial of… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2010-0774 | – | May 17 | The (1) JAX-RPC WS-Security 1.0 and (2) JAX-WS runtime implementations in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2010-1651 | – | May 3 | IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and SIP tracing (aka full trace logging for SIP) are enabled,… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more |
| CVE-2010-1650 | – | May 3 | IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.41, 6.1.x before 6.1.0.31, and 7.0.x before 7.0.0.11, when the -trace option (aka debugging mode) is enabled, executes… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2010-0770 | – | Apr 1 | IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service (ORB… Affected: through 6.0.2.39; 6.0; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.2; +34 more |
| CVE-2010-0769 | – | Apr 1 | IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 does not properly define wsadmin scripting J2CConnectionFactory objects,… Affected: through 6.0.2.39; 6.0; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.2; +34 more |
| CVE-2010-0768 | – | Apr 1 | Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9… Affected: through 6.0.2.39; 6.0.2; 6.0.2.1; 6.0.2.3; 6.0.2.5; 6.0.2.7; +34 more |
| CVE-2010-1182 | – | Mar 29 | Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors Affected: 7.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +3 more |
| CVE-2010-0425 | – | Mar 5 | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure… Affected: 6.1 before 6.1.0.31 |
| CVE-2010-0563 | – | Feb 8 | The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.5; 7.0.0.7; 7.0.0.8 |
| CVE-2009-2749 | – | Dec 8 | Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows… Affected: 7.0.0.7 |
| CVE-2009-2746 | – | Nov 16 | Cross-site request forgery (CSRF) vulnerability in the administrative console in the Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.39, 6.1 before… Affected: 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; 6.0.2.5; +34 more |
| CVE-2009-2744 | – | Sep 21 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to cause a denial of service via unknown vectors, related to "an… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +23 more |
| CVE-2009-2743 | – | Sep 21 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration… Affected: 6.1; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +16 more |
| CVE-2009-2742 | – | Sep 21 | Cross-site scripting (XSS) vulnerability in Eclipse Help in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or… Affected: 6.1; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; 6.1.0.7; +9 more |
| CVE-2009-3106 | – | Sep 8 | The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement security constraints on the (1) doGet and… Affected: 6.0.2; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +29 more |
| CVE-2009-2092 | – | Aug 13 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 does not properly read the portletServingEnabled parameter in ibm-portlet-ext.xmi, which allows remote attackers to… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.4 |
| CVE-2009-2091 | – | Aug 13 | The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.4 |
| CVE-2009-2090 | – | Aug 13 | Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass… Affected: 7.0; 7.0.0.1; 7.0.0.3; 7.0.0.4 |
| CVE-2009-2089 | – | Aug 13 | The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred,… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2009-2088 | – | Aug 13 | The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2009-2087 | – | Aug 13 | The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2009-2085 | – | Aug 13 | The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security,… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +25 more |
| CVE-2009-0906 | – | Aug 13 | The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended… Affected: 1.0; 1.0.0.2 |
| CVE-2009-0217 | – | Jul 14 | The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2009-0904 | – | Jul 5 | The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows… Affected: 6.1; 6.1.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +22 more |
| CVE-2009-0903 | – | Jun 25 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +23 more |
| CVE-2009-1901 | – | Jun 3 | The Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 permits "non-standard http methods," which has unknown impact and remote attack vectors Affected: through 6.0.2.33; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +27 more |
| CVE-2009-1900 | – | Jun 3 | The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when… Affected: through 6.0.2.33; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +27 more |
| CVE-2009-1899 | – | Jun 3 | Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35,… Affected: through 6.0.2.33; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +27 more |
| CVE-2009-1898 | – | Jun 3 | The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an… Affected: through 6.0.2.33; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +27 more |
| CVE-2009-0899 | – | Jun 3 | IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1… Affected: 6.1 through 6.1.0.24; 7.0 through 7.0.0.4 |
| CVE-2009-1174 | – | Mar 31 | The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML… Affected: 7.0; 7.0.0.1 |
| CVE-2009-1173 | – | Mar 31 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files… Affected: 7.0; 7.0.0.1 |
| CVE-2009-1172 | – | Mar 31 | The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +21 more |
| CVE-2009-0892 | – | Mar 31 | The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios"… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +21 more |
| CVE-2009-0891 | – | Mar 25 | The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33)… Affected: 6.0.2; 6.0.2; 6.0.2.1; 6.0.2.2; 6.0.2.3; 6.0.2.4; +34 more |
| CVE-2009-0508 | – | Mar 16 | The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3… Affected: 5.1.0; 5.1.1.19; 6.0.2; 6.0.2.1; 6.0.2.3; 6.0.2.5; +28 more |
| CVE-2009-0856 | – | Mar 9 | Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow… Affected: 6.1; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +18 more |
| CVE-2009-0855 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject… Affected: 6.1; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +19 more |
| CVE-2009-0506 | – | Feb 25 | Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB)… Affected: 5.1.0; 6.0.2; 6.0.2.4; 6.0.2.6; 6.0.2.8; 6.0.2.10; +7 more |
| CVE-2009-0504 | – | Feb 17 | WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which… Affected: through 7.0 |
| CVE-2008-4285 | – | Feb 17 | Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x… Affected: 6.1; 6.1.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.5; +6 more |
| CVE-2009-0438 | – | Feb 10 | IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a… Affected: 7.0 |
| CVE-2009-0437 | – | Feb 10 | The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to… Affected: 6.0.2 |
| CVE-2009-0436 | – | Feb 10 | The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect… Affected: 6.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.1; 6.0.1.1; +34 more |
| CVE-2009-0435 | – | Feb 10 | Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x… Affected: 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; +19 more |
The 500 most important CVEs for this product (exploited first, then by severity)