Filtered by vendor Esri Subscriptions
Total 97 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-38188 1 Esri 1 Portal For Arcgis 2024-11-21 6.1 Medium
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
CVE-2022-38187 1 Esri 1 Portal For Arcgis 2024-11-21 7.5 High
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
CVE-2022-38186 1 Esri 1 Portal For Arcgis 2024-11-21 6.1 Medium
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
CVE-2022-38184 1 Esri 1 Portal For Arcgis 2024-11-21 7.5 High
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
CVE-2021-3012 1 Esri 1 Arcgis Enterprise 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).
CVE-2021-29118 1 Esri 1 Arcreader 2024-11-21 5.5 Medium
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVE-2021-29117 1 Esri 1 Arcreader 2024-11-21 7.8 High
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVE-2021-29116 1 Esri 1 Arcgis Server 2024-11-21 6.1 Medium
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
CVE-2021-29115 1 Esri 1 Arcgis Enterprise 2024-11-21 5.3 Medium
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
CVE-2021-29114 1 Esri 1 Arcgis Server 2024-11-21 9.8 Critical
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
CVE-2021-29113 1 Esri 1 Arcgis Server 2024-11-21 4.7 Medium
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
CVE-2021-29112 1 Esri 1 Arcreader 2024-11-21 5.5 Medium
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVE-2021-29110 1 Esri 1 Portal For Arcgis 2024-11-21 5.4 Medium
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
CVE-2021-29109 1 Esri 1 Portal For Arcgis 2024-11-21 6.1 Medium
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVE-2021-29108 1 Esri 1 Portal For Arcgis 2024-11-21 8.8 High
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.
CVE-2021-29107 1 Esri 1 Arcgis Server 2024-11-21 6.1 Medium
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
CVE-2021-29106 1 Esri 1 Arcgis Server 2024-11-21 6.1 Medium
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVE-2021-29105 1 Esri 1 Arcgis Server 2024-11-21 5.4 Medium
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.
CVE-2021-29104 1 Esri 1 Arcgis Server 2024-11-21 6.1 Medium
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
CVE-2021-29103 1 Esri 1 Arcgis Server 2024-11-21 6.1 Medium
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.