Umn's vulnerability profile centers on MapServer, a widely embedded geospatial web mapping application found in government, research, and enterprise GIS deployments. The recurring weakness classes—memory-buffer violations, SQL injection, sensitive information exposure, input validation, and path-traversal flaws—reflect the application's role parsing user-supplied map requests and database queries, and public exploit code has been associated with vulnerabilities in this product. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Umn over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-2975MEDIUM Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or | Aug 1, 2011 | 6.8 | 33 | NO | YES |
CVE-2010-2540HIGH mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows | Aug 2, 2010 | 10.0 | 29 | NO | NO |
CVE-2009-0839HIGH Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows r | Mar 31, 2009 | 10.0 | 28 | NO | NO |
CVE-2009-2281HIGH Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute ar | Oct 23, 2009 | 10.0 | 27 | NO | NO |
CVE-2009-1176HIGH mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote atta | Mar 31, 2009 | 10.0 | 26 | NO | NO |
CVE-2009-0841HIGH Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to creat | Mar 31, 2009 | 10.0 | 26 | NO | NO |
CVE-2009-0840HIGH Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impa | Mar 31, 2009 | 10.0 | 26 | NO | NO |
CVE-2009-1177HIGH Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors. | Mar 31, 2009 | 10.0 | 25 | NO | NO |
CVE-2011-2704HIGH Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding. | Aug 1, 2011 | 7.5 | 24 | NO | NO |
CVE-2013-7262MEDIUM SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execu | Jan 5, 2014 | 6.8 | 23 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Umn.
Media articles that mention a CVE ID that affects a product developed by Umn — matched by CVE ID, not by vendor name.