Server-Side Request Forgery (SSRF)

GeoNetwork is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of caller-supplied WMS server URLs, which allows an attacker to make the server send requests to internal hosts and potentially disclose internal data, bypass authorization, or perfor...

CVE-2026-42030: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The...

EUVD-2022-28247

Malicious code in bioql PyPI...

EUVD-2022-28249

Malicious code in bioql PyPI...

EUVD-2022-28248

Malicious code in bioql PyPI...

CVE-2022-23158

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server...

CVE-2022-23157

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server...

CVE-2022-23156

Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server...

Authentication flaw

Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server...

Design/Logic Flaw

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server...

Design/Logic Flaw

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server...

CVE-2022-23158

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server...

CVE-2022-23158

CVE-2022-23158 affects Dell Wyse Device Agent (version 14.6.1.4 and earlier). A local authenticated user with standard privileges could exploit a data-exposure flaw to obtain incorrect port information and connect to a valid WMS server, exposing sensitive information. Public details in NVD/NCSC n...

CVE-2022-23157

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server...

CVE-2022-23157

Affected product : Dell Wyse Device Agent. Versions : 14.6.1.4 and earlier. Vulnerability : sensitive data exposure where an authenticated, local attacker could view sensitive information from the WMS Server. The issue is documented across multiple sources with consistent description of a local a...

CVE-2022-23156

Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server...

CVE-2022-23157: Exposure of Sensitive Information to an Unauthorized Actor

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server...

CVE-2022-23158: Permissive List of Allowed Inputs

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server...

PT-2022-15884

Name of the Vulnerable Software and Affected Versions Wyse Device Agent versions 14.6.1.4 and below Description The issue is related to an Improper Authentication vulnerability. A malicious user could potentially exploit this by providing invalid input to obtain a connection to the WMS server...

PT-2022-15886

Name of the Vulnerable Software and Affected Versions Wyse Device Agent versions 14.6.1.4 and below Description The issue allows a local authenticated user with standard privilege to potentially exploit it, providing incorrect port information and getting connected to a valid WMS server. This is ...