Ibm Websphere Application Server vulnerabilities
477 known vulnerabilities affecting ibm/websphere_application_server.
Total CVEs
477
CISA KEV
1
actively exploited
Public exploits
14
Exploited in wild
2
Severity breakdown
CRITICAL63HIGH109MEDIUM265LOW40
Vulnerabilities
Page 23 of 24
CVE-2013-6725P4LOWCVSS 3.5v6.1v7.0+39 more2014-01-16
CVE-2013-6725 [LOW] CWE-79 CVE-2013-6725: Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application
Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.
nvd
CVE-2013-6330P4LOWCVSS 3.5v7.0v7.0.0.1+20 more2014-01-16
CVE-2013-6330 [LOW] CWE-200 CVE-2013-6330: IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is
IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
nvd
CVE-2001-0389P4MEDIUMCVSS 5.0v5.1.0.32001-07-02
CVE-2001-0389 [MEDIUM] CVE-2001-0389: IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by
IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by directly calling the macro.d2w macro with a NOEXISTINGHTMLBLOCK argument.
nvd
CVE-2013-5418P4LOWCVSS 3.5v7.0v7.0.0.1+37 more2013-11-18
CVE-2013-5418 [LOW] CWE-79 CVE-2013-5418: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
nvd
CVE-2013-4004P4LOWCVSS 3.5v8.0.0.0v8.0.0.1+8 more2013-08-21
CVE-2013-4004 [LOW] CWE-79 CVE-2013-4004: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2013-0597P4LOWCVSS 3.5v8.5.0.0v8.5.0.1+34 more2013-08-21
CVE-2013-0597 [LOW] CWE-79 CVE-2013-0597: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2013-4005P4LOWCVSS 3.5v6.1v6.1.0+71 more2013-08-21
CVE-2013-4005 [LOW] CWE-79 CVE-2013-4005: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
nvd
CVE-2014-3075P4LOWCVSS 3.5v7.2v7.2.0.1+4 more2014-09-04
CVE-2014-3075 [LOW] CWE-79 CVE-2014-3075: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 a
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.
nvd
CVE-2019-4271P4LOWCVSS 3.5≥ 8.5.0.0, ≤ 8.5.5.15≥ 9.0.0.0, ≤ 9.0.0.11+5 more2019-09-17
CVE-2019-4271 [LOW] CWE-20 CVE-2019-4271: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243.
nvd
CVE-2016-0385P4LOWCVSS 3.1v7.0v7.0.0.0+64 more2016-09-01
CVE-2016-0385 [LOW] CWE-119 CVE-2016-0385: Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13,
Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
nvd
CVE-2025-27907P4LOWCVSS 2.7≥ 8.5, < 8.5.5.28≥ 9.0, < 9.0.5.24+2 more2025-04-22
CVE-2025-27907 [LOW] CWE-918 CVE-2025-27907: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). Th
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
nvd
CVE-2011-1376P4MEDIUMCVSS 4.6v6.1v6.1.0.1+33 more2012-01-19
CVE-2011-1376 [MEDIUM] CWE-264 CVE-2011-1376: iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.
iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations.
nvd
CVE-2016-0378P4LOWCVSS 3.7≤ 16.0.0.22016-11-24
CVE-2016-0378 [LOW] CWE-200 CVE-2016-0378: IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a defaul
IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.
nvd
CVE-2010-0777P4LOWCVSS 2.6v6.0v6.0.0.1+74 more2010-05-17
CVE-2010-0777 [LOW] CWE-20 CVE-2010-0777: The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31
The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle long filenames and consequently sends an incorrect file in some responses, which allows remote attackers to obtain sensitive information by reading the retrieved file.
nvd
CVE-2017-1381P4LOWCVSS 3.3≥ 7.0.0.0, ≤ 7.0.0.43≥ 8.0.0.0, ≤ 8.0.0.13+6 more2017-07-21
CVE-2017-1381 [LOW] CWE-200 CVE-2017-1381: IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could
IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152.
nvd
CVE-2009-0433P4LOWCVSS 2.6v5.1.0v5.1.0.2+71 more2009-02-10
CVE-2009-0433 [LOW] CVE-2009-0433: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x bef
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content buffering is enabled, allows attackers to cause a denial of service (daemon crash) via unknown vectors, related to a mishandling of client read failures in which clients receive many 500 HTTP
nvd
CVE-2020-4629P4LOWCVSS 3.3≥ 7.0.0.0, ≤ 7.0.0.45≥ 8.0.0.0, ≤ 8.0.0.15+6 more2020-09-30
CVE-2020-4629 [LOW] CWE-209 CVE-2020-4629: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized ac
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
nvd
CVE-2009-2089P4LOWCVSS 2.1v6.1v6.1.0+29 more2009-08-13
CVE-2009-2089 [LOW] CWE-16 CVE-2009-2089: The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before
The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allows remote authenticated users to obtain sensitive information by reading a Migration Trace file.
nvd
CVE-2001-1189P4MEDIUMCVSS 4.6v3.0v3.0.2+8 more2001-12-13
CVE-2001-1189 [MEDIUM] CVE-2001-1189: IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.
IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script.
nvd
CVE-2012-3311P4LOWCVSS 3.3v6.1.0v6.1.0.0+49 more2012-09-25
CVE-2012-3311 [LOW] CWE-264 CVE-2012-3311: IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5,
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users to bypass intended access restrictions, and read or modif
nvd