Vulnerabilities > Esri > Portal FOR Arcgis > 10.8
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-15 | CVE-2022-38191 | Cross-site Scripting vulnerability in Esri Portal for Arcgis There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application. | 5.4 |
| 2021-10-01 | CVE-2021-29108 | Improper Verification of Cryptographic Signature vulnerability in Esri Portal for Arcgis There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). | 8.8 |
| 2021-10-01 | CVE-2021-29109 | Cross-site Scripting vulnerability in Esri Portal for Arcgis A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. | 6.1 |
| 2021-10-01 | CVE-2021-29110 | Cross-site Scripting vulnerability in Esri Portal for Arcgis Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. | 5.4 |