Latest esri arcgis server Vulnerabilities

● CVE-2023-25848

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity in...

Esri ArcGIS Server>=10.8.1<=11.0

● CVE-2023-25840

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but co...

Esri ArcGIS>=10.8.1<11.1

Esri ArcGIS Server>=10.8.1<11.1

Linux Linux kernel

Microsoft Windows

● CVE-2023-25841

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 10.8.1 – 11.0 on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted co...

Esri ArcGIS>=10.8.1<11.1

Esri ArcGIS Server>=10.8.1<11.1

Linux Linux kernel

Microsoft Windows

● CVE-2022-38202

There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files o...

Esri ArcGIS Server<=10.9.1

● CVE-2022-38195

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which...

Esri ArcGIS Server<=10.9.1

● CVE-2022-38198

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on ...

Esri ArcGIS Server<=10.9.1

● CVE-2022-38197

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a cr...

Esri ArcGIS Server<=10.9.1

● CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the co...

Esri ArcGIS Server=10.7.1

Esri ArcGIS Server=10.8.1

● CVE-2022-38196

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server...

Esri ArcGIS Server<=10.9.1

● CVE-2022-38199

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to ...

Esri ArcGIS Server=10.7.1

Esri ArcGIS Server=10.8.1

Esri ArcGIS Server=10.9.1

● CVE-2021-29116

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store...

Esri ArcGIS Server=10.8.1

Esri ArcGIS Server=10.9.0

● CVE-2021-29113

A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.

Esri ArcGIS Server<=10.9.0

● CVE-2021-29114

A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of t...

Esri ArcGIS Server<=10.9.0

● CVE-2021-29103

A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially ex...

Esri ArcGIS Server<10.9.0

● CVE-2021-29105

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the...

Esri ArcGIS Server<10.9.0

● CVE-2021-29104

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server...

Esri ArcGIS Server<10.9.0

● CVE-2021-29102

A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the syste...

Esri ArcGIS Server<10.9.0

● CVE-2021-29106

A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potential...

Esri ArcGIS Server<10.9.0

● CVE-2021-29107

Esri ArcGIS Server=10.6.1

● CVE-2021-29099

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (no...

Esri ArcGIS Server<=10.8.1

● CVE-2021-29094

Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbit...

Esri ArcGIS<=10.8.1

Esri ArcGIS Server<=10.8.1

● CVE-2021-29093

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code ...

Esri ArcGIS<=10.8.1

Esri ArcGIS Server<=10.8.1

● CVE-2021-29095

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve...

Esri ArcGIS<=10.8.1

Esri ArcGIS Server<=10.8.1

● CVE-2020-35712

Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

Esri ArcGIS Server<10.8

Linux Linux kernel

Microsoft Windows

Latest esri arcgis server Vulnerabilities

Company

Resources

Contact