Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 93

Export CSV
CVE-2023-25840

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Arcgis Server Linux Kernel Windows
CVE-2021-29101

ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.

ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Esri
Products
Arcgis Geoevent Server
CVE-2021-29099

There is a SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29107

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29106

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29105

There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29103

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29102

There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.

A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29104

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29113

Remote file inclusion vulnerability in ArcGIS Server help documentation

A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29114

SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29115

An information disclosure vulnerability

An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Esri
Products
Arcgis Enterprise
CVE-2021-29116

BUG-000142180 Hosted feature services vulnerable to stored XSS

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38200

BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38199

BUG-000144172 - Remote file download issue in ArcGIS Server

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38198

BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38197

BUG-000148347 Unvalidated redirect issues in ArcGIS Server.

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38196

BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38195

BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2022-38201

An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Quickcapture