CVE-2022-24847 Improper Input Validation in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

CVE-2022-24847 Improper Input Validation in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

CVE-2022-24847 Improper Input Validation in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

CVE-2022-24847

The OSGeo GeoServer software is vulnerable to an unchecked JNDI lookup due to improper input validation. An attacker with admin rights can exploit this via the GeoServer GUI or REST API to perform class deserialization , potentially resulting in arbitrary code execution . This flaw also affects t...

CVE-2022-24816

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

Remote code execution

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816 Improper Control of Generation of Code in jai-ext

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816 Improper Control of Generation of Code in jai-ext

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816 Improper Control of Generation of Code in jai-ext

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816

CVE-2022-24816 (JAI-EXT/Jai-EXT) affects GeoServer ecosystems where JAI-EXT allows a Jiffle script to be supplied over a network and then compiled to Java code via Janino, enabling Remote Code Execution. The GeoServer downstream is specifically noted. The known remediation is that version 1.2.22 ...

PT-2022-16921

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.21.0 GeoServer versions prior to 2.20.4 GeoServer versions prior to 1.19.6 Description The GeoServer security mechanism can perform an unchecked JNDI lookup, which can be used to perform class deserialization and...

PT-2022-16896 · Jai-Ext +2 · Jai-Ext +2

Name of the Vulnerable Software and Affected Versions: JAI-EXT versions prior to 1.2.22 GeoServer affected versions not specified Description: Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via...

CVE-2022-24816

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

CVE-2022-24816: Improper Control of Generation of Code

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging JAI API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects th...

GeoServer input validation vulnerability

GeoServer is written in Java open source software server . GeoServer has an input validation error vulnerability that can be exploited by an attacker to perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and lead to arbitrary code execution...

CVE-2022-24847: Improper Input Validation

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +6 more potentially affected by CVE-2022-22965 via org.springframework:spring-webmvc (1.2.5)

org.springframework:spring-webmvc MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

VulnCheck KEV: CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

Unauthorized access vulnerability in geoserver

GeoServer is a J2EE implementation of the OpenGIS Web Server specification. GeoServer makes it easy to publish map data, allows users to update, delete and insert feature data, and makes it easy to share spatial geographic information between users. There is an unauthorized access vulnerability i...