https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:35:01 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54355 <p>MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer&#39;s OpenLayers HTML output for SERVICE=WMS&amp;REQUEST=GetMap&amp;FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.</p> <p>MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer&#39;s OpenLayers HTML output for SERVICE=WMS&amp;REQUEST=GetMap&amp;FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54355 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54355 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mapserver, Ubuntu:18.04:LTS: mapserver, Ubuntu:20.04:LTS: mapserver, Ubuntu:22.04:LTS: mapserver, Ubuntu:24.04:LTS: mapserver, Ubuntu:26.04:LTS: mapserver</p> <p>MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer&#39;s OpenLayers HTML output for SERVICE=WMS&amp;REQUEST=GetMap&amp;FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mapserver, Ubuntu:18.04:LTS: mapserver, Ubuntu:20.04:LTS: mapserver, Ubuntu:22.04:LTS: mapserver, Ubuntu:24.04:LTS: mapserver, Ubuntu:26.04:LTS: mapserver</p> <p>MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer&#39;s OpenLayers HTML output for SERVICE=WMS&amp;REQUEST=GetMap&amp;FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54355