Vulnerabilities > Esri > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-10-04 | CVE-2024-38040 | Unspecified vulnerability in Esri Portal for Arcgis There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. | 7.5 |
| 2024-04-04 | CVE-2024-25695 | Unspecified vulnerability in Esri Portal for Arcgis There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions <= 11.2 that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. | 7.2 |
| 2023-07-19 | CVE-2023-25838 | Unspecified vulnerability in Esri Arcgis Insights 2022.1 There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. | 7.5 |
| 2022-12-29 | CVE-2022-38203 | Server-Side Request Forgery (SSRF) vulnerability in Esri Portal for Arcgis Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212. | 7.5 |
| 2022-12-29 | CVE-2022-38205 | Path Traversal vulnerability in Esri Portal for Arcgis In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published content). | 7.5 |
| 2022-12-29 | CVE-2022-38211 | Unspecified vulnerability in Esri Portal for Arcgis Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212. | 7.5 |
| 2022-12-29 | CVE-2022-38212 | Unspecified vulnerability in Esri Portal for Arcgis Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203. | 7.5 |
| 2022-12-28 | CVE-2022-38202 | Path Traversal vulnerability in Esri Arcgis Server There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. | 7.5 |
| 2022-10-25 | CVE-2022-38196 | Path Traversal vulnerability in Esri Arcgis Server Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory. | 8.1 |
| 2022-08-16 | CVE-2022-38184 | Unspecified vulnerability in Esri Portal for Arcgis There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs. | 7.5 |