Vulnerabilities > Esri > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-04-08 | CVE-2021-3012 | Cross-site Scripting vulnerability in Esri Arcgis Enterprise 10.6.1/10.9 A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab). | 5.4 |
| 2021-03-25 | CVE-2021-29095 | Access of Uninitialized Pointer vulnerability in Esri Arcgis Server Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29094 | Classic Buffer Overflow vulnerability in Esri Arcgis Server Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2021-03-25 | CVE-2021-29093 | Use After Free vulnerability in Esri Arcgis Server A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. | 6.8 |
| 2019-09-11 | CVE-2019-16193 | Cross-site Scripting vulnerability in Esri Arcgis Enterprise 10.6.1 In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature. | 5.4 |