CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Trimble Cityworks Deserialization Vulnerability Leading to IIS Remote Code Execution (CVE-2025-0994)
[Affected Scope] Trimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10
[Impact] Authenticated attackers can exploit a deserialization vulnerability (CWE-502) to execute arbitrary code with system privileges on the Microsoft IIS web server
[Mitigation] Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls
Progress Telerik Report Server Authentication Bypass and Remote Code Execution Vulnerability (CVE-2024-4358) Security Advisory
[Affected Scope] Progress Telerik Report Server 2024 Q1 (10.0.24.305) and earlier versions hosted on IIS
[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to gain administrative access, access restricted functionality, or potentially execute arbitrary code
[Mitigation] Immediately upgrade Telerik Report Server to the latest secure version (2024 Q2 10.1.24.514 or later) and restrict IIS access to trusted IPs
HTTP/2 Protocol Rapid Reset Distributed Denial of Service Vulnerability (CVE-2023-44487)
[Affected Scope] All web servers, reverse proxies, load balancers, and CDN architectures that have the HTTP/2 protocol enabled
[Impact] Attackers can cause a complete Denial of Service (DoS) by rapidly opening and immediately canceling (via RST_STREAM) a massive volume of HTTP/2 streams, exhausting server CPU and memory resources
[Mitigation] Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting