CVE Vulnerability Advisory Database

[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters

[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file

[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)

[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server

[Affected Scope] Systems running affected versions of Microsoft .NET Framework and .NET Core, particularly within IIS or web application server environments.

[Impact] Unauthenticated remote attackers can trigger specific exceptions to obtain sensitive debugging information, including internal system paths and memory states.

[Mitigation] Apply the official Microsoft cumulative security updates immediately and disable detailed error messages in the web.config configuration.

[Affected Scope] Ivanti Connect Secure (ICS) versions 9.x, 22.x and Ivanti Policy Secure gateways

[Impact] Unauthenticated remote attackers can bypass access control checks on the web component, gaining unauthorized access to restricted resources and sensitive configuration data

[Mitigation] Immediately apply the official vendor patches or import the temporary mitigation XML profile provided by Ivanti to block the exploitation path