Vulnerabilities > Esri > Arcgis Server

DATE CVE VULNERABILITY TITLE RISK
2023-08-25 CVE-2023-25848 Cleartext Transmission of Sensitive Information vulnerability in Esri Arcgis Server 10.8.1/10.9.0/10.9.1
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue.
network
low complexity
esri CWE-319
5.3
2023-07-21 CVE-2023-25840 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0/10.9.1
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.
network
low complexity
esri CWE-79
3.4
2023-07-21 CVE-2023-25841 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0/10.9.1
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 10.8.1 – 11.0 on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
network
low complexity
esri CWE-79
6.1
2022-12-28 CVE-2022-38202 Path Traversal vulnerability in Esri Arcgis Server
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below.
network
low complexity
esri CWE-22
7.5
2022-10-25 CVE-2022-38195 Cross-site Scripting vulnerability in Esri Arcgis Server
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri CWE-79
6.1
2022-10-25 CVE-2022-38196 Path Traversal vulnerability in Esri Arcgis Server
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
network
low complexity
esri CWE-22
8.1
2022-10-25 CVE-2022-38197 Open Redirect vulnerability in Esri Arcgis Server
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
network
low complexity
esri CWE-601
6.1
2022-10-25 CVE-2022-38198 Cross-site Scripting vulnerability in Esri Arcgis Server 10.6.1/10.8.1/10.9.0
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri CWE-79
6.1
2022-10-25 CVE-2022-38199 Download of Code Without Integrity Check vulnerability in Esri Arcgis Server 10.7.1/10.8.1/10.9.1
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment.
network
low complexity
esri CWE-494
6.1
2022-10-25 CVE-2022-38200 Cross-site Scripting vulnerability in Esri Arcgis Server 10.7.1/10.8.1
A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1.
network
low complexity
esri CWE-79
6.1