90 matches found
CVE-2024-36401
CVE-2024-36401 Vulnerabilità di Remote Code Execution RCE nella valutazione delle espressioni dei nomi delle proprietà GeoServer è un server open source che consente agli utenti di condividere e modificare dati geospaziali. Nelle versioni precedenti alla 2.23.6, 2.24.4 e 2.25.2, diversi parametri...
cve-2024-36401-geoserver-rce
CVE-2024-36401 — RCE non autenticata in GeoServer Uno studio completo e riproducibile di CVE-2024-36401 , una vulnerabilità di esecuzione remota di codice non autenticata in GeoServer — il server open-source più diffuso per dati geospaziali. Il bug è un'eval injection : tramite i parametri degli...
CVE-2022-41852
Prova de Conceito de Execução Remota de Código na Biblioteca JXPath CVE-2022-41852 CVE-2022-41852 permite que invasores executem código no servidor de aplicações. Você pode ler mais sobre esta vulnerabilidade aqui:...
Exploit for Eval Injection in Geoserver
CVE-2024-36401 — Unauthenticated RCE in GeoServer !CVEhttp...
EUVD-2022-7135
Malicious code in bioql PyPI...
EUVD-2022-7064
Malicious code in bioql PyPI...
EUVD-2025-11953
Malicious code in bioql PyPI...
CVE-2025-59954 Knowage Contains a Remote Code Execution Vulnerability
Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27...
CVE-2025-59954
CVE-2025-59954 affects Knowage: versions 8.1.26 and earlier are vulnerable to remote code execution due to an unsafe org.apache.commons.jxpath.JXPathContext usage in MetaService.java. The issue enables a hostile actor to execute code remotely, with impact described as high on confidentiality, int...
CVE-2022-40160
DISPUTED This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA...
CVE-2022-40159
DISPUTED This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA...
CVE-2025-43955
TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs...
CVE-2025-43955
TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath...
CVE-2025-43955
TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs...
CVE-2025-43955
TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath...
PT-2025-17415 · Unknown · Commons-Jxpath +1
Name of the Vulnerable Software and Affected Versions: Convertigo versions 8.3.4 and earlier Description: The issue is related to the TwsCachedXPathAPI in Convertigo, which does not restrict the use of commons-jxpath APIs. Recommendations: For versions 8.3.4 and earlier, consider restricting acce...
CVE-2025-43955
Convertigo
Convertigo 安全漏洞
Convertigo is an open source low-code platform from Convertigo Open Source that includes a no-code application builder for full-stack mobile and web application development. A security vulnerability exists in Convertigo 8.3.4 and earlier versions that stems from the TwsCachedXPathAPI not...
