Esri vulnerabilities, page 2
195 vulnerabilities
Known vulnerabilities in Esri products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 33 products.
MediumCVE-2021-29107esri · arcgis serverThere is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.EPSS0.86%MediumCVE-2021-29115esri · arcgis_enterprise +1 moreAn information disclosure vulnerabilityThis issue may reveal field names, but not not disclose features.EPSS2.18%MediumCVE-2021-29116esri · arcgis serverBUG-000142180 Hosted feature services vulnerable to stored XSSA stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.81%MediumCVE-2021-29106esri · arcgis serverThere is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.69%MediumCVE-2021-29118esri · arcreaderEsri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAn out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.EPSS0.35%CriticalCVE-2021-29102esri · arcgis serverThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.EPSS1.58%MediumCVE-2021-29112esri · arcreaderEsri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAn out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.EPSS0.35%MediumCVE-2021-29095esri · arcgis serverArcGIS Server image service and raster analytics security update: uninitialized pointerMultiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.EPSS0.91%MediumCVE-2021-29105esri · arcgis serverThere is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.EPSS0.60%HighCVE-2021-29108esri · portal_for_arcgisThere is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.EPSS0.81%HighCVE-2021-29117esri · arcreaderarcreader use-after-freeA use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.EPSS0.44%MediumCVE-2021-29110esri · portal_for_arcgisStored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.EPSS0.66%HighCVE-2021-29098esri · arcgis desktop +5 moreArcGIS general raster security update: uninitialized pointerMultiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.EPSS2.02%CriticalCVE-2021-29114esri · arcgis serverSQL injection vulnerability in ArcGIS ServerA SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.EPSS1.04%MediumCVE-2021-29093esri · arcgis serverArcGIS Server image service and raster analytics security update: use-after-freeA use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.EPSS0.98%HighCVE-2021-29100esri · arcgis_earthArcGIS Earth has a File Parsing Directory Traversal VulnerabilityA path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.EPSS1.14%HighCVE-2021-29097esri · arcgis desktop +5 moreArcGIS general raster security update: buffer overflowMultiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.EPSS2.99%MediumCVE-2021-29104esri · arcgis serverThere is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.EPSS0.81%MediumCVE-2021-3012esri · arcgis_enterpriseesri arcgis_enterpriseA cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).EPSS0.66%CriticalCVE-2015-2002esri · arcgisruntime_sdkesri arcgisruntime_sdkThe ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.EPSS2.26%