CVE search results

1 – 10 of 23 results

Detailed view

Sort by:

CVE-2025-59431

Medium priority

Needs evaluation

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by...

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2021-32062

Medium priority

Needs evaluation

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the...

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2010-1678

Medium priority

Not affected

Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

CVE-2017-5522

Medium priority

Some fixes available 2 of 4

Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS...

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	Not affected

CVE-2016-9839

Medium priority

Some fixes available 2 of 6

In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	Not affected

CVE-2013-7262

Medium priority

Some fixes available 4 of 5

SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in...

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

CVE-2011-2975

Low priority

Ignored

Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data.

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

CVE-2011-2704

Medium priority

Fixed

Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

CVE-2011-2703

Medium priority

Fixed

Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

CVE-2010-3485

Medium priority

Ignored

SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593. NOTE: the provenance of...

1 affected package

mapserver

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
mapserver	—	—	—	—

Export to JSON

Results by page:

Search CVE reports