https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:20:08 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-04028 bdu:2023-04028 https://cve.radiocsirt.org/vuln/bdu:2023-04028 https://cve.radiocsirt.org/vuln/cnvd-2024-14589 cnvd-2024-14589 https://cve.radiocsirt.org/vuln/cnvd-2024-14589 https://cve.radiocsirt.org/vuln/euvd-2026-204779 EUVD-2026-204779 https://cve.radiocsirt.org/vuln/euvd-2026-204779 https://cve.radiocsirt.org/vuln/fkie_cve-2023-35042 <p>GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.</p> <p>GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-35042 https://cve.radiocsirt.org/vuln/ghsa-59x6-g4jr-4hxc <p><strong>Affected:</strong> Maven: org.geoserver:gs-wms, Maven: org.geoserver:gs-wfs, Maven: org.geoserver:gs-wps</p> <p>GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via `java.lang.Runtime.getRuntime().exec` in `wps:LiteralData` within a `wps:Execute` request, as exploited in the wild in June 2023.</p> <p>## RCE in Jiffle</p> <p>The Jiffle map algebra language, provided by jai-ext, allows efficiently execute map algebra over large images. A vulnerability [CVE-2022-24816](https://nvd.nist.gov/vuln/detail/CVE-2022-24816) has been recently found in Jiffle, that allows a Code Injection to be performed by properly crafting a Jiffle invocation.</p> <p>In the case of GeoServer, the injection can be performed from a remote request.</p> <p>## Assessment</p> <p>GeoTools includes the Jiffle language as part of the `gt-process-raster-&lt;version&gt;` module, applications using it should check whether it’s possible to provide a Jiffle script from remote, and if so, upgrade or remove the functionality (see also the GeoServer mitigation, below).</p> <p>The issue is of particular interest for GeoServer users, as GeoServer embeds Jiffle in the base WAR package. Jiffle is available as a OGC function, for usage in SLD rendering transformations.</p> <p>This allows for a Remote Code Execution in properly crafted OGC requests, as well as from the administration console, when editing SLD files.</p> <p>## Mitigations</p> <p>In case you cannot upgrade at once, then the following mitigation is strongly recommended:</p> <p>1. Stop GeoServer 2. Open the war file, get into `WEB-INF/lib` and remove the `janino-&lt;version&gt;.jar` 3. Restart GeoServer.…</p> <p><strong>Affected:</strong> Maven: org.geoserver:gs-wms, Maven: org.geoserver:gs-wfs, Maven: org.geoserver:gs-wps</p> <p>GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via `java.lang.Runtime.getRuntime().exec` in `wps:LiteralData` within a `wps:Execute` request, as exploited in the wild in June 2023.</p> <p>## RCE in Jiffle</p> <p>The Jiffle map algebra language, provided by jai-ext, allows efficiently execute map algebra over large images. A vulnerability [CVE-2022-24816](https://nvd.nist.gov/vuln/detail/CVE-2022-24816) has been recently found in Jiffle, that allows a Code Injection to be performed by properly crafting a Jiffle invocation.</p> <p>In the case of GeoServer, the injection can be performed from a remote request.</p> <p>## Assessment</p> <p>GeoTools includes the Jiffle language as part of the `gt-process-raster-&lt;version&gt;` module, applications using it should check whether it’s possible to provide a Jiffle script from remote, and if so, upgrade or remove the functionality (see also the GeoServer mitigation, below).</p> <p>The issue is of particular interest for GeoServer users, as GeoServer embeds Jiffle in the base WAR package. Jiffle is available as a OGC function, for usage in SLD rendering transformations.</p> <p>This allows for a Remote Code Execution in properly crafted OGC requests, as well as from the administration console, when editing SLD files.</p> <p>## Mitigations</p> <p>In case you cannot upgrade at once, then the following mitigation is strongly recommended:</p> <p>1. Stop GeoServer 2. Open the war file, get into `WEB-INF/lib` and remove the `janino-&lt;version&gt;.jar` 3. Restart GeoServer.…</p> https://cve.radiocsirt.org/vuln/ghsa-59x6-g4jr-4hxc https://cve.radiocsirt.org/vuln/gsd-2023-35042 gsd-2023-35042 https://cve.radiocsirt.org/vuln/gsd-2023-35042