IBM WebSphere Application Server vulnerabilities

IBM WebSphere Application Server 8.5 and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery have a flaw in the ORB component in IBM SDK, Java Technology Edition, which may allow a malicious IIOP server to induce loading and instantiation of arbitrary classes.

IBM WebSphere Application Server 9.0 and 8.5 contain a remote code execution vulnerability in the SOAP/JMX connector. An attacker can exploit this flaw to execute arbitrary code on the server.

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

A vulnerability in IBM WebSphere Application Server 8.5 and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 could allow a remote attacker to bypass security constraints.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

IBM WebSphere Application Server 9.0 and 8.5 traditional could allow a remote attacker to obtain sensitive information.

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.

IBM WebSphere Application Server versions 9.0 and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

IBM WebSphere Application Server 9.0 and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. This allows an attacker to inject malicious scripts into the server management interface.

IBM WebSphere Application Server 9.0 and 8.5 contain a vulnerability that could allow a remote attacker to obtain sensitive information from the integrated help system of the administrative console.

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service (DoS) attack in the WebSphere WebServer Plug-in component. An attacker can send crafted requests to the web server, causing system overload.

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, when using Intelligent Management with the WebSphere WebServer Plug-in component, are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

IBM WebSphere Application Server versions 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

IBM WebSphere Application Server and Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

IBM WebSphere Application Server 9.0 and 8.5 is affected by improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty are vulnerable to HTTP request smuggling. An attacker can send a specially crafted request that is misinterpreted by the server.

IBM WebSphere Application Server 8.5, 9.0 and Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.