Vulnerabilities > Osgeo > Mapserver > High

DATE CVE VULNERABILITY TITLE RISK
2017-03-15 CVE-2017-5522 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
network
low complexity
debian osgeo CWE-119
7.5
2016-12-08 CVE-2016-9839 Information Exposure vulnerability in Osgeo Mapserver
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
network
low complexity
osgeo CWE-200
7.5
2011-08-01 CVE-2011-2704 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
network
low complexity
osgeo umn CWE-119
7.5
2011-08-01 CVE-2011-2703 SQL Injection vulnerability in multiple products
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
network
low complexity
osgeo umn CWE-89
7.5
2009-03-31 CVE-2009-0843 Improper Input Validation vulnerability in multiple products
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
network
low complexity
osgeo umn CWE-20
7.8