Vulnerabilities > Esri > Arcgis Server > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-11 | CVE-2021-29104 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.6.1/10.7.1/10.8.1 A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. | 6.1 |
| 2021-07-11 | CVE-2021-29105 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.6.1/10.7.1/10.8.1 A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory. | 5.4 |
| 2021-07-10 | CVE-2021-29106 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.6.1/10.7.1/10.8.1 A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. | 6.1 |
| 2021-07-10 | CVE-2021-29107 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.6.1 A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. | 6.1 |
| 2021-06-07 | CVE-2021-29099 | SQL Injection vulnerability in Esri Arcgis Server A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. | 5.3 |
| 2021-03-25 | CVE-2021-29095 | Access of Uninitialized Pointer vulnerability in Esri Arcgis Server Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29094 | Classic Buffer Overflow vulnerability in Esri Arcgis Server Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29093 | Use After Free vulnerability in Esri Arcgis Server A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |