) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
- CPE Product Version: cpe:/a:ibm:websphere_application_server:8.5.0.0
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2016-0385 |
Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors. Published: September 01, 2016; 6:59:00 AM -0400 |
V3.0: 3.1 LOW V2.0: 3.5 LOW |
| CVE-2016-2960 |
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages. Published: August 07, 2016; 9:59:11 PM -0400 |
V3.0: 3.7 LOW V2.0: 4.3 MEDIUM |
| CVE-2016-0359 |
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. Published: July 03, 2016; 5:59:03 PM -0400 |
V3.0: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2016-0306 |
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors. Published: May 17, 2016; 10:08:00 AM -0400 |
V3.0: 5.9 MEDIUM V2.0: 4.3 MEDIUM |
| CVE-2015-7417 |
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider. Published: January 23, 2016; 12:59:01 AM -0500 |
V3.0: 5.4 MEDIUM V2.0: 3.5 LOW |
| CVE-2015-5004 |
The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. Published: December 15, 2015; 12:59:01 AM -0500 |
V3.x:(not available) V2.0: 4.0 MEDIUM |
| CVE-2015-4938 |
IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors. Published: August 22, 2015; 7:59:05 PM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
| CVE-2015-1932 |
IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header. Published: August 22, 2015; 7:59:01 PM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
| CVE-2015-1946 |
IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server (WAS) 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors. Published: July 14, 2015; 1:59:02 PM -0400 |
V3.x:(not available) V2.0: 4.4 MEDIUM |
| CVE-2015-1936 |
The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter. Published: July 14, 2015; 1:59:01 PM -0400 |
V3.x:(not available) V2.0: 6.0 MEDIUM |
| CVE-2015-1927 |
The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged access via unspecified vectors. Published: July 14, 2015; 1:59:00 PM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
| CVE-2015-1920 |
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session. Published: May 19, 2015; 8:59:01 PM -0400 |
V3.x:(not available) V2.0: 10.0 HIGH |
| CVE-2015-1885 |
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors. Published: April 27, 2015; 8:59:03 AM -0400 |
V3.x:(not available) V2.0: 9.3 HIGH |
| CVE-2015-1882 |
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user. Published: April 27, 2015; 8:59:02 AM -0400 |
V3.x:(not available) V2.0: 8.5 HIGH |
| CVE-2015-0175 |
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors. Published: April 27, 2015; 8:59:01 AM -0400 |
V3.x:(not available) V2.0: 5.5 MEDIUM |
| CVE-2015-0174 |
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. Published: April 27, 2015; 8:59:00 AM -0400 |
V3.x:(not available) V2.0: 4.0 MEDIUM |
| CVE-2014-8890 |
IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations. Published: December 18, 2014; 11:59:17 AM -0500 |
V3.x:(not available) V2.0: 5.1 MEDIUM |
| CVE-2014-6174 |
IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web site. Published: December 18, 2014; 11:59:14 AM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2014-6167 |
Cross-site scripting (XSS) vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Published: December 18, 2014; 11:59:13 AM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2014-6166 |
The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Published: December 18, 2014; 11:59:12 AM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |