Vulnerabilities > Esri
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-15 | CVE-2022-38190 | Cross-site Scripting vulnerability in Esri Portal for Arcgis A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser | 6.1 |
| 2022-08-15 | CVE-2022-38191 | Cross-site Scripting vulnerability in Esri Portal for Arcgis There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application. | 5.4 |
| 2022-08-12 | CVE-2021-29112 | Out-of-bounds Read vulnerability in Esri Arcreader An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user. | 5.5 |
| 2022-08-12 | CVE-2021-29117 | Use After Free vulnerability in Esri Arcreader A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. | 7.8 |
| 2022-08-12 | CVE-2021-29118 | Out-of-bounds Read vulnerability in Esri Arcreader An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user. | 5.5 |
| 2021-12-07 | CVE-2021-29113 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Esri Arcgis Server A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. | 4.7 |
| 2021-12-07 | CVE-2021-29114 | SQL Injection vulnerability in Esri Arcgis Server A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries. | 9.8 |
| 2021-12-07 | CVE-2021-29115 | Exposure of Resource to Wrong Sphere vulnerability in Esri Arcgis Enterprise 10.6.1 An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. | 5.3 |
| 2021-12-07 | CVE-2021-29116 | Cross-site Scripting vulnerability in Esri Arcgis Server 10.8.1/10.9.0 A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. | 6.1 |
| 2021-10-01 | CVE-2021-29108 | Improper Verification of Cryptographic Signature vulnerability in Esri Portal for Arcgis There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). | 8.8 |