Vulnerabilities > Esri

DATE CVE VULNERABILITY TITLE RISK
2021-12-07 CVE-2021-29113 Code Injection vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
network
esri CWE-94
4.3
2021-12-07 CVE-2021-29114 SQL Injection vulnerability in Esri Arcgis Server
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
network
low complexity
esri CWE-89
7.5
2021-12-07 CVE-2021-29115 Exposure of Resource to Wrong Sphere vulnerability in Esri Arcgis Enterprise 10.6.1/10.9
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers.
network
low complexity
esri CWE-668
5.0
2021-12-07 CVE-2021-29116 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
network
esri CWE-79
4.3
2021-10-01 CVE-2021-29108 Improper Privilege Management vulnerability in Esri Portal for Arcgis
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker to impersonate another account.
network
low complexity
esri CWE-269
6.5
2021-10-01 CVE-2021-29109 Cross-site Scripting vulnerability in Esri Portal for Arcgis
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
network
esri CWE-79
4.3
2021-10-01 CVE-2021-29110 Cross-site Scripting vulnerability in Esri Portal for Arcgis
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
network
esri CWE-79
3.5
2021-07-11 CVE-2021-29102 Server-Side Request Forgery (SSRF) vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
network
low complexity
esri CWE-918
6.4
2021-07-11 CVE-2021-29103 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
network
esri CWE-79
4.3
2021-07-11 CVE-2021-29104 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
network
esri CWE-79
4.3