Summary
| Detail | |||
|---|---|---|---|
| Vendor | Ibm | First view | 2012-05-01 |
| Product | Websphere Application Server | Last view | 2024-11-04 |
| Version | 7.0.0.27 | Type | Application |
| Update | * | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | - | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:ibm:websphere_application_server | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 5.5 | 2024-11-04 | CVE-2024-45086 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. |
| 5.5 | 2024-10-16 | CVE-2024-45072 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. |
| 4.8 | 2024-10-16 | CVE-2024-45071 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| 7.5 | 2024-10-15 | CVE-2024-45085 | IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service. |
| 7.5 | 2024-08-14 | CVE-2023-50314 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713. |
| 7.2 | 2024-07-09 | CVE-2024-35154 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641. |
| 4.8 | 2024-06-27 | CVE-2024-35153 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640. |
| 7.5 | 2024-04-25 | CVE-2024-25026 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516. |
| 7 | 2024-04-17 | CVE-2024-22354 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401. |
| 0 | 2024-04-17 | CVE-2024-22329 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack. X-Force ID: 279951. |
| 7.5 | 2024-04-04 | CVE-2024-27268 | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 284574. |
| 7.5 | 2024-03-31 | CVE-2024-22353 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400. |
| 6.1 | 2024-03-27 | CVE-2024-27270 | IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576. |
| 0 | 2024-03-01 | CVE-2023-50312 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711. |
| 7.5 | 2023-08-16 | CVE-2023-38737 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567. |
| 6.3 | 2023-05-11 | CVE-2023-27554 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185. |
| 7.5 | 2023-04-29 | CVE-2023-30441 | IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188. |
| 6.1 | 2023-04-27 | CVE-2023-24966 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904. |
| 5.9 | 2022-11-03 | CVE-2022-38712 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762." |
| 6.5 | 2022-09-28 | CVE-2022-35282 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data. |
| 5.4 | 2022-09-09 | CVE-2022-34165 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429. |
| 5.3 | 2022-07-14 | CVE-2022-22473 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347. |
| 8.8 | 2022-07-08 | CVE-2022-22476 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604. |
| 5.9 | 2022-05-20 | CVE-2022-22365 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904. |
| 6.5 | 2022-05-17 | CVE-2022-22475 | IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 20% (15) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 15% (11) | CWE-611 | Information Leak Through XML External Entity File Disclosure |
| 12% (9) | CWE-502 | Deserialization of Untrusted Data |
| 9% (7) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
| 6% (5) | CWE-200 | Information Exposure |
| 4% (3) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
| 4% (3) | CWE-290 | Authentication Bypass by Spoofing |
| 4% (3) | CWE-209 | Information Exposure Through an Error Message |
| 2% (2) | CWE-74 | Failure to Sanitize Data into a Different Plane ('Injection') |
| 1% (1) | CWE-770 | Allocation of Resources Without Limits or Throttling |
| 1% (1) | CWE-754 | Improper Check for Unusual or Exceptional Conditions |
| 1% (1) | CWE-668 | Exposure of Resource to Wrong Sphere |
| 1% (1) | CWE-565 | Reliance on Cookies without Validation and Integrity Checking |
| 1% (1) | CWE-384 | Session Fixation |
| 1% (1) | CWE-352 | Cross-Site Request Forgery (CSRF) |
| 1% (1) | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm |
| 1% (1) | CWE-311 | Missing Encryption of Sensitive Data |
| 1% (1) | CWE-310 | Cryptographic Issues |
| 1% (1) | CWE-307 | Improper Restriction of Excessive Authentication Attempts |
| 1% (1) | CWE-276 | Incorrect Default Permissions |
| 1% (1) | CWE-269 | Improper Privilege Management |
| 1% (1) | CWE-264 | Permissions, Privileges, and Access Controls |
| 1% (1) | CWE-254 | Security Features |
| 1% (1) | CWE-20 | Improper Input Validation |
OpenVAS Exploits
| id | Description |
|---|---|
| 2012-05-11 | Name : IBM WebSphere Application Server 'plugin-key.kdb' Information Disclosure Vuln... File : nvt/gb_ibm_was_plugin_key_info_disc_vuln.nasl |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2019-07-18 | IBM WebSphere Application Server remote code execution attempt RuleID : 50455 - Type : SERVER-WEBAPP - Revision : 2 |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2017-08-04 | Name: The remote web application server is affected by a cross-site scripting vulne... File: websphere_cve-2017-1380.nasl - Type: ACT_GATHER_INFO |
| 2017-08-04 | Name: The remote web application server is affected by an information disclosure vu... File: websphere_cve-2017-1381.nasl - Type: ACT_GATHER_INFO |
| 2017-08-04 | Name: The remote web application server is affected by an insecure file permissions... File: websphere_cve-2017-1382.nasl - Type: ACT_GATHER_INFO |
| 2013-07-23 | Name: The remote application server may be affected by multiple vulnerabilities. File: websphere_8_5_5.nasl - Type: ACT_GATHER_INFO |
| 2012-11-20 | Name: The remote application server may be affected by multiple vulnerabilities. File: websphere_8_5_0_1.nasl - Type: ACT_GATHER_INFO |
| 2012-04-04 | Name: The remote application server is affected by multiple vulnerabilities. File: websphere_6_1_0_43.nasl - Type: ACT_GATHER_INFO |
| 2012-04-04 | Name: The remote application server may be affected by multiple vulnerabilities. File: websphere_7_0_0_21.nasl - Type: ACT_GATHER_INFO |
| 2012-04-04 | Name: The remote application server may be affected by multiple vulnerabilities. File: websphere_8_0_0_2.nasl - Type: ACT_GATHER_INFO |
