Vulnerabilities > Esri > Arcgis Server > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-10-25 | CVE-2022-38195 | Cross-site Scripting vulnerability in Esri Arcgis Server There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. | 6.1 |
| 2022-10-25 | CVE-2022-38197 | Open Redirect vulnerability in Esri Arcgis Server Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter. | 6.1 |
| 2022-10-25 | CVE-2022-38198 | Cross-site Scripting vulnerability in Esri Arcgis Server There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. | 6.1 |
| 2022-10-25 | CVE-2022-38199 | Download of Code Without Integrity Check vulnerability in Esri Arcgis Server 10.7.1/10.8.1/10.9.1 A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. | 6.1 |
| 2022-10-25 | CVE-2022-38200 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.7.1/10.8.1 A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. | 6.1 |
| 2021-12-07 | CVE-2021-29113 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Esri Arcgis Server A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. | 4.7 |
| 2021-12-07 | CVE-2021-29116 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0 A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. | 6.1 |
| 2021-07-11 | CVE-2021-29103 | Cross-site Scripting vulnerability in Esri Arcgis Server A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. | 6.1 |
| 2021-07-11 | CVE-2021-29104 | Cross-site Scripting vulnerability in Esri Arcgis Server A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. | 6.1 |
| 2021-07-11 | CVE-2021-29105 | Cross-site Scripting vulnerability in Esri Arcgis Server A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory. | 5.4 |