CVSS: 9.8EPSS: 0%CPEs: 62EXPL: 0CVE-2013-7262
https://notcve.org/view.php?id=CVE-2013-7262
05 Jan 2014 — SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter. Vulnerabilidad de inyección SQL en la función msPostGISLayerSetTimeFilter en mappostgis.c en MapServer anterior a v6.4.1, cuando un servicio WMS-Time es utilizado permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una cadena manipulada ... • http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 3%CPEs: 70EXPL: 1CVE-2011-2975 – MapServer 6.0 - '.Map' File Double-Free Remote Denial of Service
https://notcve.org/view.php?id=CVE-2011-2975
01 Aug 2011 — Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data. Doble vulnerabilidad libre en la función msAddImageSymbol en mapsymbol.c en MapServer anterior a v6.0.1 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o tener otro impacto no especificado a través de datos mapfile manipulados. • https://www.exploit-db.com/exploits/36092 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 1%CPEs: 69EXPL: 0CVE-2011-2703
https://notcve.org/view.php?id=CVE-2011-2703
01 Aug 2011 — Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support. Múltiples vulnerabilidades de inyección SQL en MapServer anterior a v4.10.7, y v5.x anterior a v5.6.7, y v6.x anterior a v6.0.1 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores relacionados con (1) filtros codificados OGC o (2) tiempo de so... • http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 6%CPEs: 59EXPL: 0CVE-2011-2704
https://notcve.org/view.php?id=CVE-2011-2704
01 Aug 2011 — Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding. Desbordamiento de búfer basado en pila en MapServer anterior a v4.10.7 y v5.x anterior a v5.6.7 permite a atacantes remotos ejecutar código de su elección a través de vectores relacionados con el filtro codificado OGC. • http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 54EXPL: 0CVE-2010-2539
https://notcve.org/view.php?id=CVE-2010-2539
02 Aug 2010 — Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files. Desbordamiento de búfer en la función msTmpFile en maputil.c en mapserv en MapServer en versiones anteriores a la 4.10.6 y 5.x en versiones anteriores a la 5.6.4, permite a usuarios locales provocar una denegación de servicio mediante vectores que involucran nombres de ficheros temporales. • http://lists.osgeo.org/pipermail/mapserver-users/2010-July/066052.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 5%CPEs: 54EXPL: 0CVE-2010-2540
https://notcve.org/view.php?id=CVE-2010-2540
02 Aug 2010 — mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments. mapserv.c en mapserv en MapServer en versiones anteriores a la 4.10.6 y 5.x en versiones anteriores a la 5.6.4 no restringe de manera apropiada el uso de argumentos de linea de comandos CGI que se establecieron para depuración, lo que permite a atacantes remoto... • http://lists.osgeo.org/pipermail/mapserver-users/2010-July/066052.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 11%CPEs: 50EXPL: 0CVE-2009-2281
https://notcve.org/view.php?id=CVE-2009-2281
23 Oct 2009 — Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840. Múltiples desbordamiento de búfer basados en memoria dinámica en la función readPostBod... • http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 2%CPEs: 42EXPL: 1CVE-2009-1176
https://notcve.org/view.php?id=CVE-2009-1176
31 Mar 2009 — mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action. mapserv.c en mapserv en MapServer v4.x anterior a v4.10.4 y v5.x anterior a v5.2.2 no garantiza que la cadena que soporta el parámetro "id" finalice en un carácter '\0', lo que permite a atacantes remotos dirigir un... • http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 42EXPL: 1CVE-2009-1177
https://notcve.org/view.php?id=CVE-2009-1177
31 Mar 2009 — Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors. Desbordamiento múltiple de búfer basado en pila en el archivo maptemplate.c en mapserv en MapServer v4.x anteriores a v4.10.4 y v5.x anteriores a v5.2.2 con impacto desconocido y vectores de ataque remoto. • http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 6%CPEs: 42EXPL: 1CVE-2009-0839
https://notcve.org/view.php?id=CVE-2009-0839
31 Mar 2009 — Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action. Desbordamiento de búfer basado en pila en mapserv.c en mapserv en MapServer v4.x anterior a v4.10.4 y v5.x anterior a v5.2.2, cuando el servidor tiene un mapa con un atributo largo IMAGEPATH O NAME, permite a atacantes remotos ejecutar código a... • http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •