CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-32062
https://notcve.org/view.php?id=CVE-2021-32062
05 May 2021 — MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI). MapServer versiones anteriores a 7.0.8, 7.1.xy versiones 7.2.x anteriores a 7.2.3, 7.3.xy versiones 7.4.x anteriores a 7.4.5, y 7.5.x y versiones 7.6.x anteriores a 7.6.3, no aplica apropiadamente las restricciones MS_... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 4%CPEs: 25EXPL: 0CVE-2017-5522
https://notcve.org/view.php?id=CVE-2017-5522
15 Mar 2017 — Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests. Desbordamiento de búfer basado en pila en MapServer en versiones anteriores a 6.0.6, 6.2.x en versiones anteriores a 6.2.4, 6.4.x en versiones anteriores a 6.4.5 y 7.0.x en versiones anteriores a 7.0.4 permite a atacantes remotos provocar una denegación de se... • http://www.debian.org/security/2017/dsa-3766 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9839
https://notcve.org/view.php?id=CVE-2016-9839
08 Dec 2016 — In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails. En MapServer en versiones anteriores a 7.0.3, los mensajes de error del controlador OGR son demasiado verbosos y pueden filtrar información sensible si la conexión de los datos falla. • http://www.securityfocus.com/bid/94856 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 62EXPL: 0CVE-2013-7262
https://notcve.org/view.php?id=CVE-2013-7262
05 Jan 2014 — SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter. Vulnerabilidad de inyección SQL en la función msPostGISLayerSetTimeFilter en mappostgis.c en MapServer anterior a v6.4.1, cuando un servicio WMS-Time es utilizado permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una cadena manipulada ... • http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •