WE
Product
WebSphere Extreme Scale
23
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 7Low 2
Watch
Add WebSphere Extreme Scale to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13773 | 10.0 | Jun 30 | IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol Affected: 8.6.1.0 through 8.6.1.6 |
| CVE-2026-13772 | 9.9 | Jun 30 | IBM WebSphere eXtreme Scale's OQL is affected by remote code execution Affected: 8.6.1.0 through 8.6.1.6 |
| CVE-2026-13759 | 8.8 | Jun 30 | IBM WebSphere eXtreme Scale is affected by Insecure Deserilization Affected: 8.6.1.0 through 8.6.1.6 |
| CVE-2026-9002 | 6.5 | Jun 30 | IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled Affected: 8.6.1.0 through 8.6.1.6 |
| CVE-2019-4109 | 6.1 | Sep 30 | IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim Affected: 8.6.0 before 8.6.1.3 |
| CVE-2016-0400 | 6.1 | Jul 2 | CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to… Affected: 7.1.0; 7.1.0.2; 7.1.1; 8.5.0; 8.5.0.1; 8.5.0.2; +8 more |
| CVE-2019-4115 | 5.4 | Sep 30 | IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting Affected: 8.6.0 before 8.6.1.3 |
| CVE-2020-4336 | 5.3 | Jan 6 | IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters Affected: 8.6.1.0 before 8.6.1.4 |
| CVE-2019-4106 | 4.8 | Sep 30 | IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting Affected: 8.6.0 before 8.6.1.3 |
| CVE-2015-7418 | 4.4 | Feb 8 | IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user… Affected: 7.1.0; 7.1.1; 8.5; 8.6 |
| CVE-2016-2861 | 3.7 | Jul 2 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote… Affected: 7.1.0; 7.1.0.2; 7.1.1; 8.5.0; 8.5.0.1; 8.5.0.2; +9 more |
| CVE-2019-4112 | 3.3 | Sep 30 | IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system Affected: 8.6.0 before 8.6.1.3 |
| CVE-2015-2031 | – | Oct 4 | Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2030 | – | Oct 4 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2029 | – | Oct 4 | Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2028 | – | Oct 4 | CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2027 | – | Oct 4 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2026 | – | Oct 4 | Cross-site request forgery (CSRF) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to hijack the… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-2025 | – | Oct 4 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote… Affected: 7.1.0; 7.1.0.2; 7.1.1 |
| CVE-2015-4936 | – | Aug 3 | Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors Affected: 8.6.0.0; 8.6.0.1; 8.6.0.2; 8.6.0.3; 8.6.0.4; 8.6.0.5; +3 more |
| CVE-2013-5394 | – | Oct 16 | The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to conduct phishing attacks via unspecified vectors Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0 |
| CVE-2013-5393 | – | Oct 16 | The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 does not properly process logoff actions, which has unspecified impact and remote attack… Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0 |
| CVE-2013-5390 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in the monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to inject… Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0 |
Showing 23