Vulnerabilidades do Ibm WebSphere Application Server - Liberty
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ibm WebSphere Application Server - Liberty: 47 registro(s), com versões afetadas e correções.
CVE-2026-15325
Alta · 8.7
CWE-444 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
CVE-2026-15280
Alta · 7.5
CWE-22 28/07/2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
CVE-2026-15064
Alta · 8.7
CWE-444 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-15057
Alta · 7.5
CWE-787 28/07/2026
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
CVE-2026-14981
Alta · 7.5
CWE-400 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-14976
Crítica · 9.8
CWE-306 28/07/2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
CVE-2026-16192
Média · 6.5
CWE-674 28/07/2026
IBM WebSphere Application Server Liberty is affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
CVE-2026-11806
Alta · 7.5
CWE-444 30/06/2026
IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-11714
Crítica · 9.8
CWE-918 30/06/2026
IBM WebSphere Application Server Liberty: SSRF no recurso apiDiscovery-1.0
O IBM WebSphere Application Server Liberty é afetado por uma vulnerabilidade de server-side request forgery com o recurso apiDiscovery-1.0 habilitado.
CVE-2026-11546
Crítica · 9.8
CWE-918 30/06/2026
IBM WebSphere Application Server Liberty: SSRF (CVE-2026-11546)
IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.7 é afetado por uma vulnerabilidade de falsificação de requisição do lado do servidor (server-side request forgery) com o recurso adminCenter-1.0 habilitado.
CVE-2026-9320
Alta · 7.5
CWE-400 22/06/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9071
Alta · 7.5
CWE-400 22/06/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-8646
Crítica · 9.1
CWE-444 22/06/2026
Vulnerabilidade de HTTP Request Smuggling no IBM WebSphere Application Server e Liberty
Os produtos IBM WebSphere Application Server 9.0 e 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.6 são vulneráveis a HTTP request smuggling. Um atacante remoto poderia contrabandear uma requisição especialmente elaborada para o servidor de aplicação, permitindo ao atacante contornar controles de segurança, falsificar identidade, escalar privilégios e expor informações sensíveis.
CVE-2026-5516
Média · 5.9
CWE-362 27/05/2026
IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.
CVE-2026-4410
Alta · 7.5
CWE-400 27/05/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-3621
Média · 5.9
CWE-269 22/04/2026
IBM WebSphere Application Server Liberty is affected by identity spoofing
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
CVE-2026-1561
Média · 5.4
CWE-918 25/03/2026
IBM WebSphere Application Server Liberty Server-Side Request Forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2025-14917
Crítica · 9.8
CWE-1393 25/03/2026
IBM WebSphere Application Server Liberty could provide weaker than expected security
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
CVE-2025-14915
Alta · 7.2
CWE-200 25/03/2026
IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.
CVE-2025-14923
Crítica · 9.8
CWE-798 03/03/2026
IBM WebSphere Application Server Liberty could provide weaker than expected security
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
CVE-2025-14914
Alta · 7.6
CWE-22 02/02/2026
IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
CVE-2025-12635
Média · 5.4
CWE-79 08/12/2025
IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.