Esri vulnerabilities, page 3

195 vulnerabilities

Known vulnerabilities in Esri products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 33 products.

10CriticalCVE-2007-1770esri · arcsdeesri arcsdeBuffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.EPSS16.96%7.5HighCVE-2007-4278esri · arcsdeesri arcsdeStack-based buffer overflow in the giomgr process in ESRI ArcSDE service 9.2, as used with ArcGIS, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number that requires more than 8 bytes to represent in ASCII, which triggers the overflow in an sprintf function call.EPSS4.65%9.8CriticalCVE-2025-2538esri · portal_for_arcgisBUG-000174336A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.EPSS0.56%7.3HighCVE-2025-1067esri · arcgis_allsource +1 moreThere is a code injection vulnerability in ArcGIS ProThere is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.EPSS0.19%7.3HighCVE-2025-1068esri · arcgis_allsource +1 moreThere is a code injection vulnerability in Esri ArcGIS AllSourceThere is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, the file could execute and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1.EPSS0.22%4.3MediumCVE-2025-1726esri · arcgis monitor[#BUG-000172669 ArcGIS Monitor has a security vulnerability]There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is "LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1.EPSS0.41%4.8MediumCVE-2025-55106esri · portal_for_arcgis +1 moreBUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55105esri · portal_for_arcgis +1 moreBUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55104esri · portal_for_arcgis +1 moreBUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.EPSS0.19%4.8MediumCVE-2025-55103esri · portal_for_arcgis +1 moreBUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55107esri · portal_for_arcgis +1 moreBUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%9.1CriticalCVE-2025-4967esri · portal_for_arcgisServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEsri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.EPSS0.58%4.8MediumCVE-2025-57875esri · portal_for_arcgisBUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%4.8MediumCVE-2025-57871esri · portal_for_arcgisBUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%6.1MediumCVE-2025-57872esri · portal_for_arcgisBUG-000174150 - Unvalidated redirect in Portal for ArcGIS.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%6.1MediumCVE-2025-57879esri · portal_for_arcgisBUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%4.8MediumCVE-2025-57877esri · portal_for_arcgisReflected XSS vulnerability in Portal for ArcGIS.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%10CriticalCVE-2025-57870esri · arcgis serverBUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.EPSS0.54%4.8MediumCVE-2025-57874esri · portal_for_arcgisBUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%6.1MediumCVE-2025-57878esri · portal_for_arcgisBUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%