IBM WebSphere Application Server Liberty vulnerabilities

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.4 is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

IBM WebSphere Application Server Liberty is vulnerable to a denial of service (DoS) attack via a specially crafted request that causes excessive memory consumption.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller is vulnerable to a path-segment injection vulnerability in the collective routing mechanism.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.6 are affected by an arbitrary file read vulnerability when the restConnector-2.0 feature is enabled.

IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 with the adminCenter-1.0 feature enabled are affected by a server-side request forgery (SSRF) vulnerability.

IBM WebSphere Application Server Liberty versions 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.