677 matches found
CVE-2024-23818: Improper Neutralization of Input During Web Page Generation
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...
CVE-2023-41877: Improper Limitation of a Pathname to a Restricted Directory
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location ...
CVE-2023-51444
creationtimestamp| type| source ---|---|--- 2024-03-19 19:14:24+00:00| published-proof-of-concept| https://github.com/geoserver/geoserver/security/advisories/GHSA-9v5q-2gwq-q9hq...
CVE-2024-23634
creationtimestamp| type| source ---|---|--- 2024-03-19 19:14:03+00:00| published-proof-of-concept| https://github.com/geoserver/geoserver/security/advisories/GHSA-75m5-hh4r-q9gx...
CVE-2023-51445
creationtimestamp| type| source ---|---|--- 2024-03-19 19:13:06+00:00| published-proof-of-concept| https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w...
org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +7 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (1.2.5)
org.springframework:spring-web MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...
PT-2024-5226 · Apache +1 · Apache Tomcat +1
Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.5 and 2.24.3 Description: The issue is related to the GeoWebCache ByteStreamController class, where it is possible to bypass existing input validation and read arbitrary classpath resources with specific file...
PT-2024-41546
Уязвимость службы Web Map Service WMS программного обеспечения для администрирования и публикации геоданных на сервере OSGeo GeoServer связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить межсайтовые...
VulnCheck KEV: CVE-2022-24816
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution...
VulnCheck KEV: CVE-2021-40822
GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host...
GeoServer server-side request forgery vulnerability (CNVD-2024-14588)
GeoServer is an open source software server written in Java. Allows users to share and edit geospatial data. GeoServer suffers from a server-side request forgery vulnerability that stems from the fact that the OGC Web Processing Service WPS specification is designed to process information from an...
CVE-2023-5786
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...
Design/Logic Flaw
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...
CVE-2023-5786 GeoServer GeoWebCache rest.html direct request
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...
CVE-2023-5786
GeoServer GeoWebCache (up to 1.15.1) is affected by CVE-2023-5786. The vulnerability concerns unauthorized access via the /geoserver/gwc/rest.html page and can be acted on remotely; an exploit has been disclosed publicly. Several connected sources describe the issue as affecting GeoWebCache versi...
CVE-2023-5786 GeoServer GeoWebCache rest.html direct request
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...
CVE-2023-5786 GeoServer GeoWebCache rest.html direct request
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...
GeoServer GeoWebCache Security Vulnerability
GeoWebCache is a Java Web application for caching map slices from various sources, such as the OGC Web Map Service WMS. A security vulnerability exists in GeoServer GeoWebCache version 1.15.1 and earlier, which stems from an unauthorized access vulnerability in the /geoserver/gwc/rest.html page...
PT-2023-32325 · Unknown · Geoserver Geowebcache
Name of the Vulnerable Software and Affected Versions: GeoServer GeoWebCache versions up to 1.15.1 Description: A vulnerability was found in GeoServer GeoWebCache, affecting unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to a direct request. The attack can be initiated...
CVE-2023-5786: Direct Request
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the...