U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 68 matching records.
Displaying matches 61 through 68.
Vuln ID Summary CVSS Severity

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024.

Published: September 07, 2018; 11:29:00 AM -0400
V3.0: 9.8 CRITICAL
V2.0: 7.5 HIGH

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit access on non-secure (http) port and using JASPIC or JSR375 authentication.

Published: August 24, 2018; 6:29:06 AM -0400
V3.0: 5.9 MEDIUM
V2.0: 4.3 MEDIUM

IBM WebSphere Application Server Liberty prior to could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature. IBM X-Force ID: 142890.

Published: June 27, 2018; 2:29:00 PM -0400
V3.0: 7.5 HIGH
V2.0: 5.0 MEDIUM

IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 137031.

Published: March 22, 2018; 8:29:00 AM -0400
V3.0: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.

Published: January 30, 2018; 1:29:00 PM -0500
V3.0: 8.8 HIGH
V2.0: 6.5 MEDIUM

IBM WebSphere Application Server (WAS) Liberty before, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.

Published: November 24, 2016; 2:59:10 PM -0500
V3.0: 3.7 LOW
V2.0: 4.3 MEDIUM

Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients.

Published: September 30, 2016; 9:59:02 PM -0400
V3.0: 5.4 MEDIUM
V2.0: 3.5 LOW

Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Published: May 27, 2010; 3:00:01 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM