CVE Vulnerability Advisory Database

[Affected Scope] GeoServer versions from 2.25.0 to before 2.25.6, and from 2.26.0 to before 2.26.3

[Impact] Unauthenticated remote attackers can exploit the GetMap XML request to read arbitrary local files, perform Server-Side Request Forgery (SSRF), or trigger Denial of Service (DoS)

[Mitigation] Immediately upgrade GeoServer to patched versions 2.25.6, 2.26.3, or 2.27.0 and above

[Affected Scope] SysAid On-Prem versions <= 23.3.40

[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application

[Affected Scope] SysAid On-Prem versions 23.3.40 and below

[Impact] Unauthenticated remote attackers can read arbitrary system files and perform administrator account takeover, leading to full system compromise.

[Mitigation] Immediately upgrade SysAid On-Prem to version 24.4.60 or higher, and restrict external access to the Checkin endpoint prior to patching.

[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)

[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately

[Affected Scope] Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier

[Impact] A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests

[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers

[Affected Scope] Citrix StoreFront versions before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000)

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary local files, perform internal port scanning, or execute Server-Side Request Forgery (SSRF) attacks

[Mitigation] Immediately upgrade Citrix StoreFront to patched versions (1903 or later, 7.15 LTSR CU4 or later, 7.6 LTSR CU8 or later)

[Affected Scope] Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10

[Impact] Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint

[Affected Scope] BC-BMT-BPM-DSK component in SAP NetWeaver AS JAVA 7.5.

[Impact] Remote authenticated attackers can conduct XML External Entity (XXE) attacks, leading to sensitive local file disclosure, SSRF, or DoS.

[Mitigation] Apply SAP Security Note 2296909 or restrict access to the vulnerable URI endpoint.

[Affected Scope] Adobe BlazeDS 3.2 and earlier, and integrated products including LiveCycle, ColdFusion, and Flex Data Services

[Impact] Unauthenticated remote attackers can read arbitrary local files and disclose sensitive system information via crafted XML requests

[Mitigation] Apply official security patches or disable external entity resolution (XXE) in the XML parser configuration