org.geoserver.web:gs-web-app vulnerabilities (Maven)
16 vulnerabilities.
org.geoserver.web:gs-web-appMavenGeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates7.2 Highorg.geoserver.web:gs-web-appMavenGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution6.5 Mediumorg.geoserver.web:gs-web-appMavenGeoServer has an arbitrary file write vulnerability in its Master Password Dump Page7.2 Highorg.geoserver.web:gs-web-appMavenGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature8.2 Highorg.geoserver.web:gs-web-appMavenGeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format6.1 Mediumorg.geoserver.web:gs-web-appMavenGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling9.9 Criticalorg.geoserver.web:gs-web-appMavenGeoServer has an Infinite Loop Vulnerability in Jiffle process7.5 Highorg.geoserver.web:gs-web-appMavenGeoServer Missing Authorization on REST API Index5.3 Mediumorg.geoserver.web:gs-web-appMavenGeoServer Coverage REST API Allows Server Side Request Forgery5.5 Mediumorg.geoserver.web:gs-web-appMavenGWC Home Page communicate version and revision information5.3 Mediumorg.geoserver.web:gs-web-appMavenGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)9.3 Criticalorg.geoserver.web:gs-web-appMavenWelcome and About GeoServer pages communicate version and revision information5.3 Mediumorg.geoserver.web:gs-web-appMavenRemote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver9.8 Criticalorg.geoserver.web:gs-web-appMavenGeoServer's Server Status shows sensitive environmental variables and Java properties4.5 Mediumorg.geoserver.web:gs-web-appMavenClasspath resource disclosure in GWC Web Resource API on Windows / Tomcat7.5 Highorg.geoserver.web:gs-web-appMavenUnsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer8.6 High