CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
GeoServer Remote Code Execution (RCE) Critical Security Advisory (CVE-2024-36401)
[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2
[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters
[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file
Ivanti Endpoint Manager (EPM) Core Server Unauthenticated Remote Code Execution Vulnerability Advisory (CVE-2024-29824)
[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)
[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges
[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server
Microsoft .NET Framework Information Disclosure Vulnerability (CVE-2024-29059) Security Advisory
[Affected Scope] Systems running affected versions of Microsoft .NET Framework and .NET Core, particularly within IIS or web application server environments.
[Impact] Unauthenticated remote attackers can trigger specific exceptions to obtain sensitive debugging information, including internal system paths and memory states.
[Mitigation] Apply the official Microsoft cumulative security updates immediately and disable detailed error messages in the web.config configuration.
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability (CVE-2023-46805) Security Advisory
[Affected Scope] Ivanti Connect Secure (ICS) versions 9.x, 22.x and Ivanti Policy Secure gateways
[Impact] Unauthenticated remote attackers can bypass access control checks on the web component, gaining unauthorized access to restricted resources and sensitive configuration data
[Mitigation] Immediately apply the official vendor patches or import the temporary mitigation XML profile provided by Ivanti to block the exploitation path
Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26858) Urgent Security Advisory
[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments
[Impact] Remote attackers can execute arbitrary code with SYSTEM privileges, leading to full server compromise and lateral movement
[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU) and scan for Indicators of Compromise (IoCs)