Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 193

Export CSV
CVE-2024-25708

Persistent XSS when creating new application using Web App Builder

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Microsoft
Products
Arcgis Enterprise Windows
CVE-2024-25706

HTMLi at createFolder Content Injection

There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2024-25697

Stored XSS in Portal for ArcGIS

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser.  The privileges required to execute this attack are low.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2024-25696

Stored XSS in Portal for ArcGIS

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack are high.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Arcgis Esri
Products
Portal Portal For Arcgis
CVE-2024-25695

concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2024-25692

BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of low severity.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Portal For Arcgis Linux Kernel Windows
CVE-2023-25841

BUG-000158075 Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Arcgis Server Linux Kernel Windows
CVE-2023-25840

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Arcgis Server Linux Kernel Windows
CVE-2024-25707

BUG-000160241 - Reflected XSS in Portal for ArcGIS

There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript code in the their own browser (Self XSS). A user cannot be phished into clicking a link to execute code.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Portal For Arcgis Linux Kernel Windows
CVE-2024-25698

Reflected XSS in Portal for ArcGIS

There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Portal For Arcgis Linux Kernel Windows
CVE-2024-25690

HTML injection in ArcGIS Web AppBuilder

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Esri Linux Microsoft
Products
Portal For Arcgis Linux Kernel Windows
CVE-2023-25833

BUG-000155004 HTML injection issue in Portal for ArcGIS.

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2023-25832

BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2023-25834

BUG-000142922 Incomplete permission changes in specific cases.

Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2021-29101

ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.

ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Esri
Products
Arcgis Geoevent Server
CVE-2021-29099

There is a SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29107

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29106

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29105

There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2021-29103

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server