IBM WebSphere Application Server
184 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-101294 | 8.5 ; 9.0 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step | HIGH 8.7 | 0.2 % | ||
| CVE-2026-105442 | 8.5 ; 9.0 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data | HIGH 7.5 | 0.4 % | ||
| CVE-2026-93907 | 8.5 ; 9.0 | IBM WebSphere Application Server is affected by a bypass authentication vulnerability | HIGH 8.1 | 0.3 % | ||
| CVE-2026-95680 | 8.5 ; 9.0 | IBM WebSphere Application Server is affected by an authorization bypass | HIGH 8.0 | 0.2 % | ||
| CVE-2026-103499 | 8.5 ; 9.0 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-11722 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-11711 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-11710 | 8.5 | IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-11549 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-11548 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-11545 | 8.5 ; 9.0 | IBM WebSphere Application Server is affected by a privilege escalation | LOW 3.7 | 0.3 % | ||
| CVE-2026-11540 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-11539 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-11538 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-11537 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-10841 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-15396 | 9.0 ; 8.5 | IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-15412 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-15634 | 9.0 ; 8.5 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-15887 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-16186 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-16185 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-16187 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-16188 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-16190 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | LOW 3.1 | 0.2 % | ||
| CVE-2026-16189 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-16435 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-9667 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-9176 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | HIGH 7.1 | 0.2 % | ||
| CVE-2026-9327 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | HIGH 8.1 | 0.4 % | ||
| CVE-2026-9336 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | HIGH 7.5 | 0.8 % | ||
| CVE-2026-9338 | 9.0 ; 8.5 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-8400 | 8.5 ; 9.0 | Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the Jul… | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-11536 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by a remote code execution vulnerability | HIGH 8.5 | 0.6 % | ||
| CVE-2026-9322 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | HIGH 7.5 | 0.6 % | ||
| CVE-2026-10842 | 8.5 ; 9.0 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability | HIGH 7.5 | 0.5 % | ||
| CVE-2026-14529 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-14446 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by a privilege escalation | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-14515 | 8.5 ; 9.0 | IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-14512 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information | CRITICAL 9.8 | 1.0 % | ||
| CVE-2026-14528 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information | HIGH 7.5 | 0.5 % | ||
| CVE-2026-14974 | 8.5 ; 9.0 | IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-14981 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | HIGH 7.5 | 0.5 % | ||
| CVE-2026-15064 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | HIGH 8.7 | 0.3 % | ||
| CVE-2026-15325 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | HIGH 8.7 | 0.3 % | ||
| CVE-2026-15328 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests | HIGH 8.1 | 0.4 % | ||
| CVE-2026-16184 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by an authentication bypass | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-11594 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities | HIGH 8.5 | 0.3 % | ||
| CVE-2026-11595 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by a Path Traversal vulnerability | HIGH 7.5 | 0.8 % | ||
| CVE-2026-11708 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-11712 | 9.0 ; 8.5 | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-10852 | 8.5 ; 9.0 | Websphere Application Server is Affected By a Denial of Service | HIGH 7.5 | 0.5 % | ||
| CVE-2026-9320 | 9.0.0 – 7.0.2 Interim Fix 035 ; 8.5.0 – 7.0.3 Interim Fix 017 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | HIGH 7.5 | 0.6 % | ||
| CVE-2026-9071 | 9.0.0 – 7.0.2 Interim Fix 035 ; 8.5.0 – 7.0.3 Interim Fix 017 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption | HIGH 7.5 | 0.6 % | ||
| CVE-2026-9006 | 9.0 – 7.0.2 Interim Fix 035 ; 8.5.0 – 7.0.3 Interim Fix 017 | IBM WebSphere Application Server is affected by server-side request forgery | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-8646 | 9.0.0 – 7.0.2 Interim Fix 035 ; 8.5.0 – 7.0.3 Interim Fix 017 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-10845 | 8.5.0 – 7.0.2 Interim Fix 035 ; 9.0.0 – 7.0.3 Interim Fix 017 | IBM WebSphere Application Server is affected by an authentication bypass vulnerability | HIGH 7.3 | 0.5 % | ||
| CVE-2026-9072 | 8.5 ; 9.0 | WebSphere Application Server Remote Code Execution | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-8858 | 8.5 ; 9.0 | WebSphere Application Server Remote Code Execution | HIGH 8.8 | 0.4 % | ||
| CVE-2026-9330 | 9.0 – 1.1.9.12 ; 8.5 | IBM WebSphere Application Server is affected by remote code execution | HIGH 8.5 | 0.5 % | ||
| CVE-2026-9319 | 9.0 – 1.1.9.12 ; 8.5 | IBM WebSphere Application Server is affected by a remote code execution vulnerability | CRITICAL 9.0 | 0.5 % | ||
| CVE-2026-9311 | 9.0 – 1.1.9.12 ; 8.5 | IBM WebSphere Application Server is affected by remote code execution | CRITICAL 9.0 | 0.5 % | ||
| CVE-2026-8644 | 9.0 – 1.1.9.12 ; 8.5 | IBM WebSphere Application Server is affected by an identity spoofing vulnerability | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-4410 | 9.0 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2025-13333 | 9.0 – 9.0.5.27 ; 8.5 – 8.5.5.29 | IBM WebSphere Application Server could provide weaker than expected security | MEDIUM 4.9 | 0.4 % | ||
| CVE-2025-12635 | 9.0 – 2.0.18 ; 8.5 | IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-36099 | 8.5 ; 9.0 | IBM WebSphere Application Server denial of service | MEDIUM 4.9 | 0.3 % | ||
| CVE-2025-33142 | 8.5 ; 9.0 | IBM WebSphere Application Server information disclosure | HIGH 7.5 | 0.3 % | ||
| CVE-2024-56339 | 9.0 | IBM WebSphere Application Server information disclosure | HIGH 7.5 | 0.4 % | ||
| CVE-2025-36097 | 9.0 | IBM WebSphere Application Server denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2025-36038 | 8.5 ; 9.0 | IBM WebSphere Application Server code execution | CRITICAL 9.8 | 13 % | ||
| CVE-2025-33104 | 8.5, 9.0 | IBM WebSphere Application Server cross | HIGH 7.6 | 0.2 % | ||
| CVE-2025-27907 | 8.5 ; 9.0 | IBM WebSphere Application Server server-side request forgery | MEDIUM 4.1 | 0.4 % | ||
| CVE-2024-45087 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-45086 | 8.5, 9.0 | IBM WebSphere Application Server XML external entity injection | MEDIUM 5.5 | 0.4 % | ||
| CVE-2024-45071 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-45072 | 8.5, 9.0 | IBM WebSphere Application Server XML external entity injection | MEDIUM 5.5 | 0.4 % | ||
| CVE-2024-45085 | 8.5 | IBM WebSphere Application Server denial of service | HIGH 7.5 | 0.6 % | ||
| CVE-2024-45073 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 4.8 | 0.2 % | ||
| CVE-2023-50315 | 8.5, 9.0 | IBM WebSphere Application Server information disclosure | MEDIUM 5.9 | 0.3 % | ||
| CVE-2024-35154 | 8.5, 9.0 | IBM WebSphere Application Server code execution | HIGH 7.2 | 1.2 % | ||
| CVE-2024-35153 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 4.8 | 0.4 % | ||
| CVE-2024-37532 | 8.5, 9.0 | IBM WebSphere Application Server identity spoofing | HIGH 8.8 | 0.4 % | ||
| CVE-2024-25026 | 8.5, 9.0 | IBM WebSphere Application Server denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2024-22329 | 8.5, 9.0 | IBM WebSphere Application Server server-side request forgery | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-22354 | 8.5, 9.0 | IBM WebSphere Application Server XML external entity injection | HIGH 7.0 | 0.6 % | ||
| CVE-2023-50313 | 8.5, 9.0 | IBM WebSphere Application Server information disclosure | MEDIUM 6.5 | 0.2 % | ||
| CVE-2023-35890 | 8.5, 9.0 | IBM WebSphere Application Server information disclosure | MEDIUM 5.5 | 0.1 % | ||
| CVE-2023-27554 | 8.5, 9.0 | IBM WebSphere Application Server XML external entity injection | CRITICAL 9.1 | 0.9 % | ||
| CVE-2022-39161 | 7.0, 8.0, 8.5, 9.0, Liberty | IBM WebSphere Application Server information disclosure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2023-24966 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-26283 | 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 5.4 | 0.4 % | ||
| CVE-2023-23477 | 8.5, 9.0 | IBM WebSphere Application Server code execution | CRITICAL 9.8 | 1.9 % | ||
| CVE-2022-43917 | 8.5, 9.0 | IBM WebSphere Application Server information disclosure | HIGH 7.5 | 0.5 % | ||
| CVE-2022-40750 | 8.5, 9.0 | IBM WebSphere Application Server cross-site scripting | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-35282 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted | MEDIUM 6.5 | 0.3 % | ||
| CVE-2022-34336 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi | MEDIUM 5.4 | 0.5 % | ||
| CVE-2022-34165 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerabl | MEDIUM 5.4 | 0.6 % | ||
| CVE-2022-22477 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-22473 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han | MEDIUM 5.3 | 1.1 % | ||
| CVE-2022-22365 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoo | MEDIUM 5.9 | 0.6 % | ||
| CVE-2021-39038 | 9.0 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-38951 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. | HIGH 7.5 | 1.6 % | ||
| CVE-2021-29842 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames d | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-29736 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: | HIGH 8.8 | 1.1 % | ||
| CVE-2021-29754 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inboun | HIGH 8.8 | 0.7 % | ||
| CVE-2021-20492 | 8.0 ; 8.5 ; 9.0 ; … | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when p | HIGH 8.2 | 2.1 % | ||
| CVE-2021-20454 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML da | HIGH 8.2 | 2.8 % | ||
| CVE-2021-20453 | 8.0 ; 8.5 ; 9.0 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A | HIGH 8.2 | 2.5 % | ||
| CVE-2021-20480 | 7.0 ; 8.0 ; 8.5 | IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted reque | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-5016 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When applicatio | MEDIUM 6.5 | 2.5 % | ||
| CVE-2021-20354 | 8.0 ; 8.5 ; 9.0 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially | HIGH 7.5 | 4.1 % | ||
| CVE-2021-20353 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d | HIGH 8.2 | 5.2 % | ||
| CVE-2020-4949 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d | HIGH 8.2 | 4.8 % | ||
| CVE-2020-4782 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker cou | MEDIUM 6.5 | 2.6 % | ||
| CVE-2020-4576 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a spe | HIGH 7.5 | 2.0 % | ||
| CVE-2020-4629 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information fro | LOW 3.3 | 0.3 % | ||
| CVE-2020-4643 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d | HIGH 7.5 | 2.8 % | ||
| CVE-2020-4578 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi | MEDIUM 5.4 | 0.7 % | ||
| CVE-2020-4589 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special | CRITICAL 9.8 | 8.5 % | ||
| CVE-2020-4534 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system | HIGH 8.8 | 0.4 % | ||
| CVE-2020-4464 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with | HIGH 8.8 | 13 % | ||
| CVE-2020-4450 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specia | CRITICAL 9.8 | 34 % | ||
| CVE-2020-4449 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a spe | HIGH 7.5 | 4.0 % | ||
| CVE-2020-4448 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the sy | CRITICAL 9.8 | 13 % | ||
| CVE-2020-4365 | 8.5 | IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenti | MEDIUM 5.3 | 1.4 % | ||
| CVE-2020-4329 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to ob | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-4362 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-b | HIGH 8.8 | 2.4 % | ||
| CVE-2020-4276 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-b | HIGH 7.5 | 3.1 % | ||
| CVE-2019-4670 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper dat | MEDIUM 6.5 | 1.8 % | ||
| CVE-2020-4163 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a malicio | HIGH 7.2 | 1.6 % | ||
| CVE-2019-4720 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. | HIGH 7.5 | 1.8 % | ||
| CVE-2019-4663 | Liberty | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr | MEDIUM 5.4 | 0.6 % | ||
| CVE-2019-4441 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack | MEDIUM 5.3 | 1.6 % | ||
| CVE-2019-4305 | Liberty | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a c | MEDIUM 5.3 | 1.5 % | ||
| CVE-2019-4304 | Liberty | IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validati | MEDIUM 6.3 | 1.0 % | ||
| CVE-2019-4505 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, ca | MEDIUM 5.3 | 2.4 % | ||
| CVE-2019-4477 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused | MEDIUM 6.5 | 1.3 % | ||
| CVE-2019-4442 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacke | MEDIUM 4.3 | 2.1 % | ||
| CVE-2019-4271 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. | LOW 3.5 | 0.8 % | ||
| CVE-2019-4270 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users | MEDIUM 5.4 | 0.7 % | ||
| CVE-2019-4268 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker cou | MEDIUM 5.3 | 2.7 % | ||
| CVE-2019-4285 | Liberty | IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persua | MEDIUM 5.4 | 1.1 % | ||
| CVE-2019-4269 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a s | HIGH 7.5 | 2.7 % | ||
| CVE-2019-4279 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted | CRITICAL 9.8 | 80 % | ||
| CVE-2019-4080 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper par | MEDIUM 6.5 | 3.1 % | ||
| CVE-2019-4046 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers | HIGH 7.5 | 3.2 % | ||
| CVE-2018-1902 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to | MEDIUM 4.3 | 1.5 % | ||
| CVE-2018-1890 | 7.0 ; 8.0 ; 8.5 ; … | IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevat | HIGH 7.8 | 0.5 % | ||
| CVE-2019-4030 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS | MEDIUM 5.4 | 0.7 % | ||
| CVE-2018-1996 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuratio | MEDIUM 5.3 | 1.1 % | ||
| CVE-2018-1926 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper valida | HIGH 8.8 | 1.2 % | ||
| CVE-2018-1901 | 8.5 ; 9.0 ; Liberty | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by | HIGH 8.8 | 1.5 % | ||
| CVE-2018-1904 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrativ | CRITICAL 9.8 | 3.7 % | ||
| CVE-2018-1957 | 9 | IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based | MEDIUM 5.5 | 0.4 % | ||
| CVE-2018-1840 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security | HIGH 8.1 | 2.1 % | ||
| CVE-2018-1905 | 9.0.0.0 ; 9.0.0.1 ; 9.0.0.2 ; … | IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML d | HIGH 7.1 | 2.5 % | ||
| CVE-2018-1797 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse dire | MEDIUM 6.3 | 2.0 % | ||
| CVE-2018-1643 | 7.0 ; 8.0 ; 8.5 ; … | The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vu | MEDIUM 6.1 | 1.5 % | ||
| CVE-2018-1798 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi | MEDIUM 6.1 | 1.5 % | ||
| CVE-2018-1851 | Liberty | IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by imp | CRITICAL 9.8 | 3.9 % | ||
| CVE-2018-1767 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users | MEDIUM 6.1 | 1.4 % | ||
| CVE-2018-1777 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi | MEDIUM 5.4 | 1.0 % | ||
| CVE-2018-1770 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker cou | MEDIUM 6.5 | 3.5 % | ||
| CVE-2018-1838 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper h | MEDIUM 6.5 | 1.6 % | ||
| CVE-2018-1794 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows use | MEDIUM 6.1 | 1.4 % | ||
| CVE-2018-1793 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows user | MEDIUM 6.1 | 1.4 % | ||
| CVE-2018-1683 | unspecified | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB | HIGH 7.5 | 2.0 % | ||
| CVE-2018-1719 | 8.5 ; 9.0 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a do | MEDIUM 5.9 | 2.4 % | ||
| CVE-2018-1567 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connect | CRITICAL 9.8 | 3.8 % | ||
| CVE-2018-1695 | 7.0 ; 8.0 ; 8.5.5 | IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attack | HIGH 7.3 | 2.2 % | ||
| CVE-2018-1755 | Liberty | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being | MEDIUM 5.9 | 3.5 % | ||
| CVE-2018-1621 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by | MEDIUM 6.7 | 0.3 % | ||
| CVE-2018-1614 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote | HIGH 7.5 | 2.9 % | ||
| CVE-2017-1743 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han | MEDIUM 4.3 | 1.8 % | ||
| CVE-2017-1788 | 9 | IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: | MEDIUM 5.3 | 2.3 % | ||
| CVE-2017-1741 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han | MEDIUM 4.3 | 2.0 % | ||
| CVE-2017-1731 | 9.0 ; 7.0.0.35 ; 7.0.0.37 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. A | HIGH 8.8 | 2.8 % | ||
| CVE-2017-1501 | 8.0 ; 8.5 ; 9.0 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the w | MEDIUM 5.9 | 2.0 % | ||
| CVE-2017-1504 | 9.0 | IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable | MEDIUM 6.5 | 0.9 % | ||
| CVE-2017-1382 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissio | HIGH 7.1 | 0.4 % | ||
| CVE-2017-1380 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi | MEDIUM 5.4 | 1.0 % | ||
| CVE-2017-1381 | 7.0 ; 8.0 ; 8.5 ; … | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensit | LOW 3.3 | 0.4 % | ||
| CVE-2016-9736 | 8.0 ; 8.5 ; 8.5.5 ; … | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. | MEDIUM 5.3 | 2.3 % |