CVSS: 9.8EPSS: 7%CPEs: 25EXPL: 0CVE-2017-5522
https://notcve.org/view.php?id=CVE-2017-5522
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests. Desbordamiento de búfer basado en pila en MapServer en versiones anteriores a 6.0.6, 6.2.x en versiones anteriores a 6.2.4, 6.4.x en versiones anteriores a 6.4.5 y 7.0.x en versiones anteriores a 7.0.4 permite a atacantes remotos provocar una denegación de servicio (caída) o ejecutar código arbitrario a través de vectores que implican solicitudes WFS de obtención de función. • http://www.debian.org/security/2017/dsa-3766 http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6 http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4 http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5 http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4 https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4df https://lists.osgeo.org/pipermail/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9839
https://notcve.org/view.php?id=CVE-2016-9839
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails. En MapServer en versiones anteriores a 7.0.3, los mensajes de error del controlador OGR son demasiado verbosos y pueden filtrar información sensible si la conexión de los datos falla. • http://www.securityfocus.com/bid/94856 https://github.com/mapserver/mapserver/pull/5356 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 62EXPL: 0CVE-2013-7262
https://notcve.org/view.php?id=CVE-2013-7262
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter. Vulnerabilidad de inyección SQL en la función msPostGISLayerSetTimeFilter en mappostgis.c en MapServer anterior a v6.4.1, cuando un servicio WMS-Time es utilizado permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una cadena manipulada en un filtro PostGIS TIME. • http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1 http://www.securityfocus.com/bid/64671 https://github.com/mapserver/mapserver/commit/3a10f6b829297dae63492a8c63385044bc6953ed https://github.com/mapserver/mapserver/issues/4834 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 70EXPL: 1CVE-2011-2975 – MapServer 6.0 - '.Map' File Double-Free Remote Denial of Service
https://notcve.org/view.php?id=CVE-2011-2975
Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data. Doble vulnerabilidad libre en la función msAddImageSymbol en mapsymbol.c en MapServer anterior a v6.0.1 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o tener otro impacto no especificado a través de datos mapfile manipulados. • https://www.exploit-db.com/exploits/36092 http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html http://trac.osgeo.org/mapserver/ticket/3939 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 69EXPL: 0CVE-2011-2703
https://notcve.org/view.php?id=CVE-2011-2703
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support. Múltiples vulnerabilidades de inyección SQL en MapServer anterior a v4.10.7, y v5.x anterior a v5.6.7, y v6.x anterior a v6.0.1 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores relacionados con (1) filtros codificados OGC o (2) tiempo de soporte WMS. • http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html http://secunia.com/advisories/45257 http://secunia.com/advisories/45318 http://secunia.com/advisories/45368 http://trac.osgeo.org/mapserver/ticket/3903 http://www.debian.org/security/2011/dsa-2285 http://www.openwall.com/lists/oss-security/2011/07/19/11 http://www.openwall.com/lists/oss-security/2011/07/19/14 http://www.openwall.com/lists/oss-security/2011/07/20/15 http://www.securityfocu • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •