Jul 1, 2024
3 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
OSGeo GeoServer GeoTools Eval Injection
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.
OSGeo GeoServerClosed Jul 15, 2024
- ClosedHighPatched
regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)
Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.
OpenSSH sshd (glibc-based Linux)Closed Jul 1, 2024
- ClosedMediumPatched
Cisco NX-OS Command Injection
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Added to the CISA KEV catalog on 2024-07-02.
Cisco NX-OSClosed Jul 2, 2024
