Vulnerabilities > Esri > Arcgis Server > Medium

DATE CVE VULNERABILITY TITLE RISK
2025-03-03 CVE-2024-10904 Unspecified vulnerability in Esri Arcgis Server 10.9.1/11.1
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri
4.8
2025-03-03 CVE-2024-51942 Unspecified vulnerability in Esri Arcgis Server 10.9.1/11.1
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri
4.8
2025-03-03 CVE-2024-51944 Unspecified vulnerability in Esri Arcgis Server 10.9.1/11.1
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri
4.8
2022-10-25 CVE-2022-38195 Cross-site Scripting vulnerability in Esri Arcgis Server
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri CWE-79
6.1
2022-10-25 CVE-2022-38197 Open Redirect vulnerability in Esri Arcgis Server
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
network
low complexity
esri CWE-601
6.1
2022-10-25 CVE-2022-38198 Cross-site Scripting vulnerability in Esri Arcgis Server
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
network
low complexity
esri CWE-79
6.1
2022-10-25 CVE-2022-38199 Download of Code Without Integrity Check vulnerability in Esri Arcgis Server 10.7.1/10.8.1/10.9.1
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment.
network
low complexity
esri CWE-494
6.1
2022-10-25 CVE-2022-38200 Cross-site Scripting vulnerability in Esri Arcgis Server 10.7.1/10.8.1
A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1.
network
low complexity
esri CWE-79
6.1
2021-12-07 CVE-2021-29113 Inclusion of Functionality from Untrusted Control Sphere vulnerability in Esri Arcgis Server
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
network
low complexity
esri CWE-829
4.7
2021-12-07 CVE-2021-29116 Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
network
low complexity
esri CWE-79
6.1