Vulnerabilities in geoserver
31 resultsVexday analysis
GeoServer apresenta 30 vulnerabilidades catalogadas, com 2 sob ataque ativo confirmado (KEV) e 4 críticas por CVSS, indicando risco operacional concreto. A fraqueza dominante é injeção de conteúdo (CWE-79), padrão clássico em aplicações web, com 3 novas vulnerabilidades publicadas nos últimos 90 dias sinalizando evolução recente da superfície de ataque.
CVE-2024-23640MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style PublisherEPSS 0.4%CVE-2024-23642MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG RendererEPSS 0.4%CVE-2024-23643MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed FormEPSS 0.4%CVE-2024-23818MEDIUMGeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers FormatEPSS 0.4%CVE-2024-23821MEDIUMGeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-34696MEDIUM GeoServer's Server Status shows sensitive environmental variables and Java propertiesEPSS 0.4%CVE-2024-38524MEDIUMGWC Home Page communicate version and revision informationEPSS 0.4%CVE-2024-40625MEDIUMGeoServer Coverage REST API Allows Server Side Request ForgeryEPSS 0.3%CVE-2025-21621MEDIUMGeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML formatEPSS 0.3%CVE-2025-58175MEDIUMGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%