WebSphere Application Server - Liberty vulnerabilities
42 known vulnerabilities in WebSphere Application Server - Liberty from IBM. 42 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
WebSphere Application Server - Liberty: Uncontrolled Resource Consumption
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
- 9.1 Critical severity
WebSphere Application Server - Liberty: Incorrect Authorization
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- 9.1 Critical severity
WebSphere Application Server - Liberty: Session Fixation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
- 8.2 High severity
WebSphere Application Server - Liberty: Deserialization of Untrusted Data
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
- 9.1 Critical severity
WebSphere Application Server - Liberty: Improper Access Control
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
- 7.5 High severity
WebSphere Application Server: Deserialization of Untrusted Data
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
- 8.7 High severity
WebSphere Application Server - Liberty: Missing Cryptographic Step
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
- 7.5 High severity
WebSphere Application Server - Liberty: Uncontrolled Resource Consumption
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
- 9.4 Critical severity
WebSphere Application Server - Liberty: Missing Authentication for Critical Functionality
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
- 9.8 Critical severity
WebSphere Application Server: Use of Externally-Controlled Input to Select Classes or Code
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitr
- 7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
- 7.5 High severity
WebSphere Application Server: Authentication Bypass by Alternate Name
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
- 8.8 High severity
WebSphere Application Server - Liberty: Improper Privilege Management
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
- 7.5 High severity
WebSphere Application Server - Liberty: Allocation of Resources Without Limits or Throttling
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
- 8.8 High severity
WebSphere Application Server - Liberty: Cross-Site Request Forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
- 9.8 Critical severity
WebSphere Application Server: Missing Authentication for Critical Functionality
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
- 8.7 High severity
WebSphere Application Server: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
- 7.5 High severity
WebSphere Application Server - Liberty: Improper Limitation of a Pathname to a Restricted Directory
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
- 8.7 High severity
WebSphere Application Server: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
- 7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
- 9.8 Critical severity
WebSphere Application Server - Liberty: Missing Authentication for Critical Functionality
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
- 7.5 High severity
WebSphere Application Server - Liberty: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
- 9.8 Critical severity
WebSphere Application Server - Liberty: Server-Side Request Forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
- 7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to c
- 7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to c
- 9.1 Critical severity
WebSphere Application Server: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowi
- 7.5 High severity
WebSphere Application Server - Liberty: Uncontrolled Resource Consumption
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attac
- 9.8 Critical severity
WebSphere Application Server - Liberty: Use of Default Password
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
- 7.2 High severity
WebSphere Application Server - Liberty: Exposure of Sensitive Information to an Unauthorized Actor
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.
- 9.8 Critical severity
WebSphere Application Server - Liberty: Use of Hard-coded Credentials
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
- 7.6 High severity
WebSphere Application Server Liberty: Improper Limitation of a Pathname to a Restricted Directory
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
- 7.5 High severity
WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling
IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
- 7.5 High severity
WebSphere Application Server Liberty: Privilege Chaining
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration
- 7.5 High severity
WebSphere Application Server: Trusting HTTP Permission Methods on the Server Side
IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.
- 7.5 High severity
WebSphere Application Server: Stack-based Buffer Overflow
IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume e
- 7.5 High severity
WebSphere Application Server: Allocation of Resources Without Limits or Throttling
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause t
- 7.0 High severity
WebSphere Application Server: Improper Restriction of XML External Entity Reference
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to exp
- 7.5 High severity
WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling
IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Fo
- 7.5 High severity
WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling
IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Fo
- 9.8 Critical severity
IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than…
IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775.