Esri
Page 2 of 2 — Esri CVEs from a corpus of 172, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25834 | Medium | 5.4 | 2023-05-09 | Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content… |
CVE-2022-38212 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-38211 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and… |
CVE-2022-38210 | Medium | 6.1 | 2022-12-29 | There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to crea… |
CVE-2022-38209 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2022-38208 | Medium | 6.1 | 2022-12-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that cou… |
CVE-2022-38207 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38206 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38205 | High | 8.6 | 2022-12-29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker… |
CVE-2022-38204 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a craf… |
CVE-2022-38203 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-38202 | High | 7.5 | 2022-12-28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker t… |
CVE-2022-38201 | Medium | 6.1 | 2022-11-15 | An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker… |
CVE-2022-38200 | Medium | 6.1 | 2022-10-25 | A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests c… |
CVE-2022-38199 | Medium | 6.1 | 2022-10-25 | A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated atta… |
CVE-2022-38198 | Medium | 6.1 | 2022-10-25 | There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated… |
CVE-2022-38197 | Medium | 6.1 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessin… |
CVE-2022-38196 | Medium | 6.5 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated att… |
CVE-2022-38195 | Medium | 6.1 | 2022-10-25 | There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convinc… |
CVE-2022-38189 | Medium | 5.4 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38184 | High | 7.5 | 2022-08-16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access… |
CVE-2022-38194 | Medium | 6.7 | 2022-08-16 | In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a prop… |
CVE-2022-38193 | Medium | 6.1 | 2022-08-16 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings w… |
CVE-2022-38192 | Medium | 6.1 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38191 | Medium | 6.1 | 2022-08-15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some… |
CVE-2022-38190 | Medium | 6.1 | 2022-08-15 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store ma… |
CVE-2022-38188 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafte… |
CVE-2022-38187 | High | 7.5 | 2022-08-15 | Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attac… |
CVE-2022-38186 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click o… |
CVE-2021-29118 | Medium | 5.5 | 2022-08-12 | An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker… |
CVE-2021-29117 | High | 7.8 | 2022-08-12 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbit… |
CVE-2021-29112 | Medium | 5.5 | 2022-08-12 | An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker… |
CVE-2021-29116 | Medium | 6.1 | 2021-12-07 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, u… |
CVE-2021-29115 | Medium | 5.3 | 2021-12-07 | An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to vie… |
CVE-2021-29114 | Critical | 9.8 | 2021-12-07 | A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confide… |
CVE-2021-29113 | Medium | 4.7 | 2021-12-07 | A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html int… |
CVE-2021-29110 | Medium | 5.4 | 2021-10-01 | Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home a… |
CVE-2021-29109 | Medium | 6.1 | 2021-10-01 | A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link w… |
CVE-2021-29108 | High | 8.8 | 2021-10-01 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authe… |
CVE-2021-29105 | Medium | 5.4 | 2021-07-11 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker t… |
CVE-2021-29104 | Medium | 6.1 | 2021-07-11 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and sto… |
CVE-2021-29103 | Medium | 6.1 | 2021-07-11 | A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on… |
CVE-2021-29102 | Critical | 9.1 | 2021-07-11 | A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET… |
CVE-2021-29107 | Medium | 6.1 | 2021-07-10 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and sto… |
CVE-2021-29106 | Medium | 6.1 | 2021-07-10 | A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to clic… |
CVE-2021-29099 | Medium | 5.3 | 2021-06-07 | A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information… |
CVE-2021-29101 | High | 7.5 | 2021-05-05 | ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to… |
CVE-2021-29100 | High | 7.8 | 2021-05-05 | A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted… |
CVE-2021-3012 | Medium | 5.4 | 2021-04-08 | A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitra… |
CVE-2021-29098 | High | 7.8 | 2021-03-25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and… |
CVE-2021-29097 | High | 7.8 | 2021-03-25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS… |
CVE-2021-29095 | Medium | 6.8 | 2021-03-25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacke… |
CVE-2021-29094 | Medium | 6.8 | 2021-03-25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with… |
CVE-2021-29093 | Medium | 6.8 | 2021-03-25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specializ… |
CVE-2021-29096 | High | 7.8 | 2021-03-25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (… |
CVE-2020-35712 | Critical | 9.8 | 2020-12-26 | Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. |
CVE-2019-16193 | Medium | 5.4 | 2019-09-11 | In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature. |
CVE-2015-2002 | Critical | 9.8 | 2018-03-29 | The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class… |
CVE-2014-9741 | | 2015-07-08 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attack… | |
CVE-2014-5122 | | 2014-08-22 | Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… | |
CVE-2014-5121 | | 2014-08-22 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecif… | |
CVE-2013-7232 | | 2013-12-30 | SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map o… | |
CVE-2013-7231 | | 2013-12-30 | Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbit… | |
CVE-2013-5222 | | 2013-12-30 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via… | |
CVE-2013-5221 | | 2013-09-24 | The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2)… | |
CVE-2012-4949 | | 2012-11-14 | SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for… | |
CVE-2012-1661 | | 2012-07-12 | ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attacke… | |
CVE-2007-4278 | | 2007-08-15 | Stack-based buffer overflow in the giomgr process in ESRI ArcSDE service 9.2, as used with ArcGIS, allows remote attackers to cause a denial of service (crash)… | |
CVE-2007-1770 | | 2007-03-30 | Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered Arc… | |
CVE-2006-0089 | | 2006-01-05 | Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .am… | |
CVE-2005-1394 | | 2005-05-03 | Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME enviro… | |
CVE-2005-1393 | | 2005-05-03 | Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmaste… |