Vulnerabilidades do Ibm Websphere Application Server

CVE-2026-105442 Alta · 7.5 CWE-502 13/10/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

CVE-2026-101294 Alta · 8.7 CWE-325 13/10/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

CVE-2026-95680 Alta · 8.0 CWE-287 13/10/2026

IBM WebSphere Application Server is affected by an authorization bypass

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVE-2026-93907 Alta · 8.1 CWE-287 13/10/2026

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass...

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-103499 Alta · 7.5 CWE-400 13/10/2026

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-11541 Crítica · 9.8 CWE-444 30/06/2026

Contrabando de requisições HTTP (HTTP Request Smuggling) no IBM WebSphere Application Server e Liberty (CVE-2026-11541)

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3 e 10.1, IBM WebSphere Application Server 9.0 e 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.6 são afetados por uma vulnerabilidade de contrabando de requisições HTTP (HTTP request smuggling).

CVE-2026-11594 Média · 6.1 CWE-79 30/06/2026

IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

CVE-2026-11806 Alta · 7.5 CWE-444 30/06/2026

IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

CVE-2026-11714 Crítica · 9.8 CWE-918 30/06/2026

IBM WebSphere Application Server Liberty: SSRF no recurso apiDiscovery-1.0

O IBM WebSphere Application Server Liberty é afetado por uma vulnerabilidade de server-side request forgery com o recurso apiDiscovery-1.0 habilitado.

CVE-2026-11712 Crítica · 9.3 CWE-79 30/06/2026

XSS no sistema de ajuda do console administrativo do IBM WebSphere Application Server

O IBM WebSphere Application Server 9.0 e 8.5 é afetado por uma vulnerabilidade de cross-site scripting no sistema de ajuda do console administrativo.

CVE-2026-11708 Crítica · 9.3 CWE-79 30/06/2026

Cross-site scripting no sistema de ajuda do console administrativo do IBM WebSphere Application Server

A IBM WebSphere Application Server 9.0, e 8.5 é afetado por uma vulnerabilidade de cross-site scripting no sistema de ajuda integrado do console administrativo.

CVE-2026-11595 Alta · 7.5 CWE-22 30/06/2026

IBM WebSphere Application Server is affected by a Path Traversal vulnerability

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

CVE-2026-11546 Crítica · 9.8 CWE-918 30/06/2026

IBM WebSphere Application Server Liberty: SSRF (CVE-2026-11546)

IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.7 é afetado por uma vulnerabilidade de falsificação de requisição do lado do servidor (server-side request forgery) com o recurso adminCenter-1.0 habilitado.

CVE-2026-10852 Alta · 7.5 CWE-476 22/06/2026

Websphere Application Server is Affected By a Denial of Service

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.

CVE-2026-9320 Alta · 7.5 CWE-400 22/06/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVE-2026-9072 Crítica · 9.8 CWE-94 22/06/2026

IBM WebSphere WebServer Plug-in: injeção de código e negação de serviço

IBM WebSphere Application Server e IBM WebSphere Application Server Liberty - quando usados com Intelligent Management e o componente WebSphere WebServer Plug-in - são vulneráveis a execução remota de código e negação de serviço. Essa vulnerabilidade pode ser explorada quando um atacante se faz passar por servidores backend e envia respostas forjadas ao plug-in.

CVE-2026-9071 Alta · 7.5 CWE-400 22/06/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVE-2026-9006 Crítica · 9.1 CWE-918 22/06/2026

IBM WebSphere Application Server: SSRF no Ajax Proxy

O IBM WebSphere Application Server 9.0 e 8.5 é vulnerável a server-side request forgery (SSRF) quando o Ajax Proxy está configurado. Isso pode permitir que um atacante envie requisições não autorizadas a partir do sistema, resultando em bypass de segurança ou divulgação de informações.

CVE-2026-8858 Alta · 8.8 CWE-94 22/06/2026

WebSphere Application Server Remote Code Execution

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

CVE-2026-8646 Crítica · 9.1 CWE-444 22/06/2026

Vulnerabilidade de HTTP Request Smuggling no IBM WebSphere Application Server e Liberty

Os produtos IBM WebSphere Application Server 9.0 e 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.6 são vulneráveis a HTTP request smuggling. Um atacante remoto poderia contrabandear uma requisição especialmente elaborada para o servidor de aplicação, permitindo ao atacante contornar controles de segurança, falsificar identidade, escalar privilégios e expor informações sensíveis.

CVE-2026-10845 Alta · 7.3 CWE-287 22/06/2026

IBM WebSphere Application Server is affected by an authentication bypass vulnerability

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

CVE-2026-9330 Alta · 8.5 CWE-502 01/06/2026

IBM WebSphere Application Server is affected by remote code execution

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

CVE-2026-9319 Crítica · 9.0 CWE-502 01/06/2026

IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

CVE-2026-9311 Crítica · 9.0 CWE-94 01/06/2026

IBM WebSphere Application Server is affected by remote code execution

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

CVE-2026-8644 Crítica · 9.1 CWE-290 01/06/2026

IBM WebSphere Application Server is affected by an identity spoofing vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.