Vulnerabilities > Esri > Arcgis Server > 10.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-12-28 | CVE-2022-38202 | Path Traversal vulnerability in Esri Arcgis Server There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. | 7.5 |
| 2022-10-25 | CVE-2022-38195 | Cross-site Scripting vulnerability in Esri Arcgis Server There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. | 6.1 |
| 2022-10-25 | CVE-2022-38196 | Path Traversal vulnerability in Esri Arcgis Server Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory. | 8.1 |
| 2022-10-25 | CVE-2022-38197 | Open Redirect vulnerability in Esri Arcgis Server Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter. | 6.1 |
| 2021-12-07 | CVE-2021-29114 | SQL Injection vulnerability in Esri Arcgis Server A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries. | 9.8 |
| 2021-06-07 | CVE-2021-29099 | SQL Injection vulnerability in Esri Arcgis Server A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. | 5.3 |
| 2021-03-25 | CVE-2021-29095 | Access of Uninitialized Pointer vulnerability in Esri Arcgis Server Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29094 | Classic Buffer Overflow vulnerability in Esri Arcgis Server Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29093 | Use After Free vulnerability in Esri Arcgis Server A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2020-12-26 | CVE-2020-35712 | Server-Side Request Forgery (SSRF) vulnerability in Esri Arcgis Server Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. | 9.3 |