This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Ibm First view 2012-01-19
Product Websphere Application Server Last view 2024-10-16
Version 8.0.0.1 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:ibm:websphere_application_server

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
5.5 2024-10-16 CVE-2024-45072

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

4.8 2024-10-16 CVE-2024-45071

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

7.5 2024-08-14 CVE-2023-50314

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713.

7.2 2024-07-09 CVE-2024-35154

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.

4.8 2024-06-27 CVE-2024-35153

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640.

7.5 2024-03-31 CVE-2024-22353

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400.

7.5 2023-08-16 CVE-2023-38737

IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567.

9.1 2023-05-11 CVE-2023-27554

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.

7.5 2023-04-29 CVE-2023-30441

IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.

6.1 2023-04-27 CVE-2023-24966

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.

5.9 2022-11-03 CVE-2022-38712

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."

6.5 2022-09-28 CVE-2022-35282

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.

5.4 2022-09-09 CVE-2022-34165

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429.

5.3 2022-07-14 CVE-2022-22473

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347.

8.8 2022-07-08 CVE-2022-22476

IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.

5.9 2022-05-20 CVE-2022-22365

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.

6.5 2022-05-17 CVE-2022-22475

IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.

6.5 2022-05-13 CVE-2022-22393

IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. IBM X-Force ID: 222078.

5.4 2022-02-24 CVE-2021-39038

IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968.

8.8 2022-01-25 CVE-2021-39031

IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.

6.5 2022-01-19 CVE-2022-22310

IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to JAX-WS applications. IBM X-Force ID: 217224.

5.3 2021-09-16 CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.

8.8 2021-07-30 CVE-2021-29736

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300.

8.8 2021-06-11 CVE-2021-29754

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association Interceptor (TAI). IBM X-Force ID: 202006.

8.2 2021-05-26 CVE-2021-20492

IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.

CWE : Common Weakness Enumeration

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
%idName
26% (34) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
14% (19) CWE-200 Information Exposure
6% (9) CWE-611 Information Leak Through XML External Entity File Disclosure
6% (9) CWE-502 Deserialization of Untrusted Data
6% (9) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...
5% (7) CWE-20 Improper Input Validation
4% (6) CWE-264 Permissions, Privileges, and Access Controls
3% (5) CWE-284 Access Control (Authorization) Issues
3% (4) CWE-352 Cross-Site Request Forgery (CSRF)
2% (3) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
2% (3) CWE-290 Authentication Bypass by Spoofing
2% (3) CWE-209 Information Exposure Through an Error Message
1% (2) CWE-770 Allocation of Resources Without Limits or Throttling
1% (2) CWE-254 Security Features
1% (2) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
1% (2) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')
0% (1) CWE-668 Exposure of Resource to Wrong Sphere
0% (1) CWE-565 Reliance on Cookies without Validation and Integrity Checking
0% (1) CWE-384 Session Fixation
0% (1) CWE-327 Use of a Broken or Risky Cryptographic Algorithm
0% (1) CWE-311 Missing Encryption of Sensitive Data
0% (1) CWE-310 Cryptographic Issues
0% (1) CWE-307 Improper Restriction of Excessive Authentication Attempts
0% (1) CWE-276 Incorrect Default Permissions
0% (1) CWE-269 Improper Privilege Management

Open Source Vulnerability Database (OSVDB)

id Description
78332 IBM WebSphere Application Server iscdeploy Script Inscure Permissions Multipl...
78321 IBM WebSphere Application Server Hash Collission Form Parameter Parsing Remot...

OpenVAS Exploits

id Description
2012-01-23 Name : IBM WebSphere Application Server Hash Collisions DOS Vulnerability
File : nvt/gb_ibm_was_hash_collisions_dos_vuln.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0141 Multiple Security Vulnerabilities in IBM WebSphere Application Server
Severity: Category I - VMSKEY: V0061061
2014-B-0065 Multiple Vulnerabilities in IBM WebSphere Application Server
Severity: Category I - VMSKEY: V0051617
2013-B-0008 Multiple Vulnerabilities in IBM WebSphere Application Server
Severity: Category I - VMSKEY: V0036644

Snort® IPS/IDS

Date Description
2019-07-18 IBM WebSphere Application Server remote code execution attempt
RuleID : 50455 - Type : SERVER-WEBAPP - Revision : 2

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2017-08-04 Name: The remote web application server is affected by an insecure file permissions...
File: websphere_cve-2017-1382.nasl - Type: ACT_GATHER_INFO
2017-08-04 Name: The remote web application server is affected by an information disclosure vu...
File: websphere_cve-2017-1381.nasl - Type: ACT_GATHER_INFO
2017-08-04 Name: The remote web application server is affected by a cross-site scripting vulne...
File: websphere_cve-2017-1380.nasl - Type: ACT_GATHER_INFO
2016-12-29 Name: The remote web application server is affected by an information disclosure vu...
File: websphere_8_5_5_10.nasl - Type: ACT_GATHER_INFO
2016-11-07 Name: The remote web application server is affected by an information disclosure vu...
File: websphere_16_0_0_3.nasl - Type: ACT_GATHER_INFO
2016-11-03 Name: The remote web application server is affected by multiple vulnerabilities.
File: websphere_9_0_0_2.nasl - Type: ACT_GATHER_INFO
2016-08-04 Name: A web application server running on the remote host is affected by an HTTP re...
File: websphere_16_0_0_2.nasl - Type: ACT_GATHER_INFO
2016-04-04 Name: The remote web application server is affected by an XSS vulnerability.
File: websphere_8_5_5_9.nasl - Type: ACT_GATHER_INFO
2015-09-18 Name: The remote IBM HTTP Server is affected by multiple vulnerabilities.
File: websphere_8_5_5_7.nasl - Type: ACT_GATHER_INFO
2015-07-09 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_8_5_5_6.nasl - Type: ACT_GATHER_INFO
2015-05-08 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_8_5_5_5.nasl - Type: ACT_GATHER_INFO
2015-03-17 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_7_0_0_37.nasl - Type: ACT_GATHER_INFO
2015-02-18 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_8_0_0_10.nasl - Type: ACT_GATHER_INFO
2015-01-07 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_8_5_5_4.nasl - Type: ACT_GATHER_INFO
2014-12-03 Name: The remote Windows host has web portal software installed that is affected by...
File: websphere_portal_7_0_0_2_cf29.nasl - Type: ACT_GATHER_INFO
2014-11-12 Name: The remote Windows host has web portal software installed that is affected by...
File: websphere_portal_cve-2014-3083.nasl - Type: ACT_GATHER_INFO
2014-11-12 Name: The remote Windows host has web portal software installed that is affected by...
File: websphere_portal_8_5_0_0_cf02.nasl - Type: ACT_GATHER_INFO
2014-10-30 Name: The remote Windows host has web portal software installed that is affected by...
File: websphere_portal_8_0_0_1_cf14.nasl - Type: ACT_GATHER_INFO
2014-10-21 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_7_0_0_35.nasl - Type: ACT_GATHER_INFO
2014-08-29 Name: The remote application server may be affected by multiple vulnerabilities.
File: websphere_8_5_5_3.nasl - Type: ACT_GATHER_INFO
2014-08-11 Name: The remote backup service is affected by multiple vulnerabilities.
File: ibm_tsm_server_6_2_6_0.nasl - Type: ACT_GATHER_INFO
2014-08-11 Name: The remote backup service is affected by multiple vulnerabilities.
File: ibm_tsm_server_6_1_x.nasl - Type: ACT_GATHER_INFO
2014-08-11 Name: The remote backup service is affected by multiple vulnerabilities.
File: ibm_tsm_server_5_5_x.nasl - Type: ACT_GATHER_INFO
2014-08-04 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_8_0_0_9.nasl - Type: ACT_GATHER_INFO
2014-08-01 Name: The remote application server is affected by multiple vulnerabilities.
File: websphere_7_0_0_33.nasl - Type: ACT_GATHER_INFO