CVE-2023-52107

CVE-2023-52107 affects Huawei HarmonyOS (and EMUI) WMS module where permissions are not strictly verified, constituting a privilege-checking laxity vulnerability. Descriptions across sources indicate that exploitation could compromise service confidentiality. The CVSS metrics (AV:N/AC:L/PR:N/UI:N...

CVE-2023-52107

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52107

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

PT-2024-14401 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a vulnerability where parameters are not verified in the WMS module. Successful exploitation of this vulnerability may affect service...

CVE-2023-52104: Undefined Security Weakness

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52102: Improper Encoding or Escaping of Output

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52107: Improper Privilege Management

Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-41339

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

CVE-2023-41339

GeoServer exposes a Server-Side Request Forgery (SSRF) risk via the dynamic styling parameter sld= in GetMap/GetLegendGraphic/GetFeatureInfo when URL checks are not configured. The vulnerability enables an attacker to cause the server to fetch external resources, potentially capturing NetNTLMv2 h...

CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...

GHSA-CQPC-X2C6-2GMF Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...

PT-2023-27915 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.22.5 GeoServer versions prior to 2.23.2 GeoServer version 2.10.3 GeoServer version 2.11.1 Description: The issue concerns the use of dynamic styles in GeoServer, which can lead to Service Side Request Forgery. Th...

CVE-2023-37241

Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart...

Input validation

Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart...

CVE-2023-37241

Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart...

CVE-2023-37241

CVE-2023-37241 is an input verification vulnerability in the WMS API. Exploitation could cause the affected device to restart. The available connected sources confirm the issue and its impact but do not provide concrete exploit details, affected versions, or a validated fix/update. No remediation...

CVE-2023-37241

Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart...

PT-2023-25850 · Wms Api · Wms Api

Name of the Vulnerable Software and Affected Versions: WMS API affected versions not specified Description: The issue is related to an input verification vulnerability in the WMS API. Successful exploitation of this issue may cause the device to restart. Recommendations: At the moment, there is n...