Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 75

Export CSV
CVE-2024-51952

Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51951

Stored XSS in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51950

Stored XSS in Server Admin under Services > lifecycleinfos

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51949

Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51948

Stored XSS vulnerability in Rest Services under Job ID

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51947

Stored XSS vulnerability in Rest Services under Layer name

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51946

Stored XSS in Rest Services Directory under Identify operation

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51945

Stored XSS issues in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51944

Stored XSS in Rest Services Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51942

Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-10904

Stored XSS in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2023-25841

BUG-000158075 Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Arcgis Server Linux Kernel Windows
CVE-2023-25840

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Arcgis Server Linux Kernel Windows
CVE-2021-29099

There is a SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29107

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29106

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29105

There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29103

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29102

There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.

A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29104

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server