← Back

Websphere Application Server

websphere_application_server

Vendor: Ibm • 465 CVEs

CVEs (465)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-27554
1Ibm
1Websphere Application Server
Jun 17, 2026
May 11, 2023
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...Show more
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185. Show less
CVE-2022-39161
1Ibm
1Websphere Application Server
Jun 17, 2026
May 3, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenti...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235069.Show less
CVE-2023-30441
1Ibm
4Infosphere Information Server
JavaWebsphere Application Server+1 more
Jun 17, 2026
Apr 29, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
CVE-2023-24966
1Ibm
1Websphere Application Server
Jun 17, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.Show less
CVE-2023-26283
1Ibm
1Websphere Application Server
Jun 17, 2026
Apr 2, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more
IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248416.Show less
CVE-2023-23477
1Ibm
1Websphere Application Server
Jun 17, 2026
Feb 3, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.
CVE-2022-43917
1Ibm
1Websphere Application Server
Jun 17, 2026
Jan 26, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version...Show more
IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045. Show less
CVE-2022-40750
1Ibm
1Websphere Application Server
Jun 17, 2026
Nov 11, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more
IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.Show less
CVE-2022-38712
1Ibm
1Websphere Application Server
Jun 17, 2026
Nov 3, 2022
N/A· v4
5.9 MEDIUM· v3
N/A· v2
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
CVE-2022-35282
1Ibm
1Websphere Application Server
Jun 17, 2026
Sep 28, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.Show less
CVE-2022-34336
1Ibm
1Websphere Application Server
Jun 17, 2026
Sep 13, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229714.Show less
CVE-2022-34165
1Ibm
1Websphere Application Server
Jun 17, 2026
Sep 9, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an a...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429.Show less
CVE-2022-22477
1Ibm
1Websphere Application Server
Jun 17, 2026
Jul 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 225605.Show less
CVE-2022-22473
1Ibm
1Websphere Application Server
Jun 17, 2026
Jul 14, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347.Show less
CVE-2022-22476
1Ibm
2Open Liberty
Websphere Application Server
Jun 17, 2026
Jul 8, 2022
N/A· v4
8.8 HIGH· v3
6.0 MEDIUM· v2
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.
CVE-2022-22365
1Ibm
1Websphere Application Server
Jun 17, 2026
May 20, 2022
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.Show less
CVE-2022-22475
1Ibm
2Open Liberty
Websphere Application Server
Jun 17, 2026
May 17, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.
CVE-2022-22393
1Ibm
1Websphere Application Server
Jun 17, 2026
May 13, 2022
N/A· v4
6.5 MEDIUM· v3
3.5 LOW· v2
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are ac...Show more
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. IBM X-Force ID: 222078.Show less
CVE-2021-39038
1Ibm
1Websphere Application Server
Jun 17, 2026
Feb 24, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mal...Show more
IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968.Show less
CVE-2021-39031
1Ibm
1Websphere Application Server
Jun 17, 2026
Jan 25, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerab...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.Show less