https://pwn.watch/t/osgeo Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 15 Jul 2024 00:00:00 GMT https://pwn.watch/i/osgeo-geoserver-cve-2024-36401 https://pwn.watch/i/osgeo-geoserver-cve-2024-36401 Mon, 15 Jul 2024 00:00:00 GMT critical <p>OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-07-15: CISA added CVE-2024-36401 to the KEV catalog (federal deadline 2024-08-05) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-07-01: CVE-2024-36401 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-36401">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-36401</p> https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816 https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816 Wed, 26 Jun 2024 00:00:00 GMT critical <p>OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-24816 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-06-26: CISA added CVE-2022-24816 to the KEV catalog (federal deadline 2024-07-17) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2022-24816</p>