# cve.now: Esri

The newest entries naming Esri as an affected vendor (up to 200), of 177 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-50096](https://cve.now/CVE-2026-50096.md): BUG-000187164 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
- [CVE-2026-50095](https://cve.now/CVE-2026-50095.md): BUG-000187165 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
- [CVE-2026-33522](https://cve.now/CVE-2026-33522.md): BUG-000182936 - ArcGIS Server has a security vulnerability. (CVSS 5.3)
- [CVE-2026-33521](https://cve.now/CVE-2026-33521.md): BUG-000186514 - ArcGIS Server has a security vulnerability. (CVSS 7.5)
- [CVE-2026-33520](https://cve.now/CVE-2026-33520.md): BUG-000185167 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
- [CVE-2026-10757](https://cve.now/CVE-2026-10757.md): BUG-000187511 - ArcGIS Server has a security vulnerability. (CVSS 9.8)
- [CVE-2026-69226](https://cve.now/CVE-2026-69226.md): Portal for ArcGIS has a security vulnerability (CVSS 6.5)
- [CVE-2026-10759](https://cve.now/CVE-2026-10759.md): BUG-000171040 Portal for ArcGIS has a security vulnerability (CVSS 5.5)
- [CVE-2026-69227](https://cve.now/CVE-2026-69227.md): BUG-000187331 Portal for ArcGIS has a security vulnerability (CVSS 9.8)
- [CVE-2026-10758](https://cve.now/CVE-2026-10758.md): Esri Lerc has a security vulnerability (CVSS 7.5)
- [CVE-2026-69233](https://cve.now/CVE-2026-69233.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
- [CVE-2026-69234](https://cve.now/CVE-2026-69234.md): reflected cross site scripting vulnerability in Esri Portal for ArcGIS (CVSS 6.1)
- [CVE-2026-69235](https://cve.now/CVE-2026-69235.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1)
- [CVE-2026-69236](https://cve.now/CVE-2026-69236.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1)
- [CVE-2026-69237](https://cve.now/CVE-2026-69237.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 3.8)
- [CVE-2026-69232](https://cve.now/CVE-2026-69232.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
- [CVE-2026-69231](https://cve.now/CVE-2026-69231.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
- [CVE-2026-69230](https://cve.now/CVE-2026-69230.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
- [CVE-2026-69229](https://cve.now/CVE-2026-69229.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 5.4)
- [CVE-2026-69228](https://cve.now/CVE-2026-69228.md): missing authentication vulnerability in Esri Portal for ArcGIS (CVSS 5.3)
- [CVE-2026-69225](https://cve.now/CVE-2026-69225.md): information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 5.9)
- [CVE-2026-69238](https://cve.now/CVE-2026-69238.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 3.5)
- [CVE-2026-69224](https://cve.now/CVE-2026-69224.md): information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 5.9)
- [CVE-2026-13019](https://cve.now/CVE-2026-13019.md): Missing Authentication (CVSS 9.8)
- [CVE-2026-13020](https://cve.now/CVE-2026-13020.md): Weak Password Recovery Mechanism in Portal for ArcGIS (CVSS 8.1)
- [CVE-2026-9181](https://cve.now/CVE-2026-9181.md): Directory Traversal in ArcGIS Server (CVSS 9.8)
- [CVE-2026-9182](https://cve.now/CVE-2026-9182.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 9.8)
- [CVE-2026-2813](https://cve.now/CVE-2026-2813.md): Unvalidated Redirect in ArcGIS Server (CVSS 4.7)
- [CVE-2026-2812](https://cve.now/CVE-2026-2812.md): Improper Authentication issue in ArcGIS Server (CVSS 5.3)
- [CVE-2026-33519](https://cve.now/CVE-2026-33519.md): Incorrect privilege assignment in Portal for ArcGIS (CVSS 9.8)
- [CVE-2026-33518](https://cve.now/CVE-2026-33518.md): Incorrect privilege assignment in Portal for ArcGIS (CVSS 9.8)
- [CVE-2026-1446](https://cve.now/CVE-2026-1446.md): XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier (CVSS 5.0)
- [CVE-2025-67711](https://cve.now/CVE-2025-67711.md): Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67710](https://cve.now/CVE-2025-67710.md): Stored XSS vulnerability in ArcGIS Server (CVSS 6.1)
- [CVE-2025-67709](https://cve.now/CVE-2025-67709.md): There is a cross site scripting issue in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67708](https://cve.now/CVE-2025-67708.md): Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67707](https://cve.now/CVE-2025-67707.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6)
- [CVE-2025-67706](https://cve.now/CVE-2025-67706.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6)
- [CVE-2025-67705](https://cve.now/CVE-2025-67705.md): Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67704](https://cve.now/CVE-2025-67704.md): Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67703](https://cve.now/CVE-2025-67703.md): Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2025-67712](https://cve.now/CVE-2025-67712.md): HTML injection issue in ArcGIS Web App Builder (CVSS 4.7)
- [CVE-2025-57870](https://cve.now/CVE-2025-57870.md): BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. (CVSS 10.0)
- [CVE-2025-57871](https://cve.now/CVE-2025-57871.md): BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1) (CVSS 4.8)
- [CVE-2025-57872](https://cve.now/CVE-2025-57872.md): BUG-000174150 - Unvalidated redirect in Portal for ArcGIS. (CVSS 6.1)
- [CVE-2025-57873](https://cve.now/CVE-2025-57873.md): BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8)
- [CVE-2025-57874](https://cve.now/CVE-2025-57874.md): BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1) (CVSS 4.8)
- [CVE-2025-57875](https://cve.now/CVE-2025-57875.md): BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8)
- [CVE-2025-57877](https://cve.now/CVE-2025-57877.md): Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8)
- [CVE-2025-57878](https://cve.now/CVE-2025-57878.md): BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect. (CVSS 6.1)
- [CVE-2025-57879](https://cve.now/CVE-2025-57879.md): BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS. (CVSS 6.1)
- [CVE-2025-57876](https://cve.now/CVE-2025-57876.md): Stored XSS vulnerability in Portal for ArcGIS (CVSS 4.8)
- [CVE-2025-55107](https://cve.now/CVE-2025-55107.md): BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8)
- [CVE-2025-55106](https://cve.now/CVE-2025-55106.md): BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability. (CVSS 4.8)
- [CVE-2025-55105](https://cve.now/CVE-2025-55105.md): BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8)
- [CVE-2025-55104](https://cve.now/CVE-2025-55104.md): BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability. (CVSS 4.8)
- [CVE-2025-55103](https://cve.now/CVE-2025-55103.md): BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8)
- [CVE-2025-4967](https://cve.now/CVE-2025-4967.md): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (CVSS 9.1)
- [CVE-2025-2538](https://cve.now/CVE-2025-2538.md): BUG-000174336 (CVSS 9.8)
- [CVE-2024-51966](https://cve.now/CVE-2024-51966.md): Directory traversal vulnerability in ArcGIS Server (CVSS 4.9)
- [CVE-2024-51963](https://cve.now/CVE-2024-51963.md): Stored XSS in ArcGIS Server Manager (CVSS 4.8)
- [CVE-2024-51962](https://cve.now/CVE-2024-51962.md): SQL injection vulnerability in ArcGIS Server (CVSS 8.7)
- [CVE-2024-51961](https://cve.now/CVE-2024-51961.md): Local file inclusion (LFI) vulnerability in ArcGIS Server (CVSS 7.5)
- [CVE-2024-51960](https://cve.now/CVE-2024-51960.md): Stored XSS in ArcGIS Server Administrator Directory (CVSS 4.8)
- [CVE-2024-51959](https://cve.now/CVE-2024-51959.md): Stored XSS issue in Server Admin API (CVSS 4.8)
- [CVE-2024-51958](https://cve.now/CVE-2024-51958.md): Directory traversal vulnerability in the admin api for service thumbnails (CVSS 4.9)
- [CVE-2024-51957](https://cve.now/CVE-2024-51957.md): Stored XSS vulnerability in ArcGIS Rest Services Directory (CVSS 4.8)
- [CVE-2024-51956](https://cve.now/CVE-2024-51956.md): Stored XSS vulnerability in ArcGIS Server Administrator Directory (CVSS 4.8)
- [CVE-2024-51954](https://cve.now/CVE-2024-51954.md): Unauthorized access to secure services in ArcGIS Server (CVSS 8.5)
- [CVE-2024-51953](https://cve.now/CVE-2024-51953.md): Stored XSS in ArcGIS Server Rest services (CVSS 4.8)
- [CVE-2024-51952](https://cve.now/CVE-2024-51952.md): Stored XSS issue in ArcGIS Server (CVSS 4.8)
- [CVE-2024-51951](https://cve.now/CVE-2024-51951.md): Stored XSS in Server Admin API (CVSS 4.8)
- [CVE-2024-51950](https://cve.now/CVE-2024-51950.md): Stored XSS in Server Admin under Services \> lifecycleinfos (CVSS 4.8)
- [CVE-2024-51949](https://cve.now/CVE-2024-51949.md): Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service (CVSS 4.8)
- [CVE-2024-51948](https://cve.now/CVE-2024-51948.md): Stored XSS vulnerability in Rest Services under Job ID (CVSS 4.8)
- [CVE-2024-51947](https://cve.now/CVE-2024-51947.md): Stored XSS vulnerability in Rest Services under Layer name (CVSS 4.8)
- [CVE-2024-51946](https://cve.now/CVE-2024-51946.md): Stored XSS in Rest Services Directory under Identify operation (CVSS 4.8)
- [CVE-2024-51945](https://cve.now/CVE-2024-51945.md): Stored XSS issues in Server Admin API (CVSS 4.8)
- [CVE-2024-51944](https://cve.now/CVE-2024-51944.md): Stored XSS in Rest Services Directory (CVSS 4.8)
- [CVE-2024-51942](https://cve.now/CVE-2024-51942.md): Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page (CVSS 4.8)
- [CVE-2024-10904](https://cve.now/CVE-2024-10904.md): Stored XSS in Server Admin API (CVSS 4.8)
- [CVE-2024-5888](https://cve.now/CVE-2024-5888.md): Stored XSS in Rest Services API for a Toolbox published as GP Service (CVSS 4.8)
- [CVE-2025-1726](https://cve.now/CVE-2025-1726.md): \[#BUG-000172669 ArcGIS Monitor has a security vulnerability\] (CVSS 4.3)
- [CVE-2025-1068](https://cve.now/CVE-2025-1068.md): There is a code injection vulnerability in Esri ArcGIS AllSource (CVSS 7.3)
- [CVE-2025-1067](https://cve.now/CVE-2025-1067.md): There is a code injection vulnerability in ArcGIS Pro (CVSS 7.3)
- [CVE-2024-38040](https://cve.now/CVE-2024-38040.md): BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability (CVSS 7.5)
- [CVE-2024-38038](https://cve.now/CVE-2024-38038.md): BUG-000165732 - Reflected XSS in Portal for ArcGIS (CVSS 6.1)
- [CVE-2024-25691](https://cve.now/CVE-2024-25691.md): BUG-000165286 - Reflected XSS in Portal for ArcGIS (CVSS 6.1)
- [CVE-2024-25694](https://cve.now/CVE-2024-25694.md): BUG-000163019 - Stored XSS in Portal for ArcGIS (CVSS 4.8)
- [CVE-2024-25701](https://cve.now/CVE-2024-25701.md): BUG-000160765 - Stored XSS in ArcGIS Experience Builder (CVSS 4.8)
- [CVE-2024-25702](https://cve.now/CVE-2024-25702.md): BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder (CVSS 4.8)
- [CVE-2024-25707](https://cve.now/CVE-2024-25707.md): BUG-000160241 - Reflected XSS in Portal for ArcGIS (CVSS 4.8)
- [CVE-2024-38036](https://cve.now/CVE-2024-38036.md): BUG-000154827 - Reflected XSS in ArcGIS Experience Builder (CVSS 5.4)
- [CVE-2024-8149](https://cve.now/CVE-2024-8149.md): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (CVSS 4.6)
- [CVE-2024-38039](https://cve.now/CVE-2024-38039.md): BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS. (CVSS 5.4)
- [CVE-2024-8148](https://cve.now/CVE-2024-8148.md): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1) (CVSS 6.1)
- [CVE-2024-38037](https://cve.now/CVE-2024-38037.md): BUG-000167983 - Unvalidated redirect in Portal for ArcGIS (CVSS 6.1)
- [CVE-2024-25699](https://cve.now/CVE-2024-25699.md): Portal for ArcGIS has an invalid authentication vulnerability (CVSS 8.5)
- [CVE-2024-25705](https://cve.now/CVE-2024-25705.md): Cross site scripting issue in embed widget (CVSS 5.4)
- [CVE-2024-25706](https://cve.now/CVE-2024-25706.md): HTMLi at createFolder Content Injection (CVSS 6.1)
- [CVE-2024-25709](https://cve.now/CVE-2024-25709.md): Self-XSS style in move item dialog (CVSS 6.1)
- [CVE-2024-25700](https://cve.now/CVE-2024-25700.md): Persistent XSS in URL added to a shared map (CVSS 4.8)
- [CVE-2024-25698](https://cve.now/CVE-2024-25698.md): Reflected XSS in Portal for ArcGIS (CVSS 6.1)
- [CVE-2024-25693](https://cve.now/CVE-2024-25693.md): Portal for ArcGIS has a directory traversal vulnerability. (CVSS 9.9)
- [CVE-2024-25695](https://cve.now/CVE-2024-25695.md): concatenated errors resulting in cross site scripting and frame injection issues. (CVSS 7.2)
- [CVE-2024-25696](https://cve.now/CVE-2024-25696.md): Stored XSS in Portal for ArcGIS (CVSS 4.8)
- [CVE-2024-25697](https://cve.now/CVE-2024-25697.md): Stored XSS in Portal for ArcGIS (CVSS 5.4)
- [CVE-2024-25690](https://cve.now/CVE-2024-25690.md): HTML injection in ArcGIS Web AppBuilder (CVSS 4.7)
- [CVE-2024-25708](https://cve.now/CVE-2024-25708.md): Persistent XSS when creating new application using Web App Builder (CVSS 4.8)
- [CVE-2024-25692](https://cve.now/CVE-2024-25692.md): BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS (CVSS 5.4)
- [CVE-2023-25848](https://cve.now/CVE-2023-25848.md): BUG-000158039 - There is an information disclosure issue in ArcGIS Server. (CVSS 5.3)
- [CVE-2023-25841](https://cve.now/CVE-2023-25841.md): BUG-000158075 Stored XSS issue in ArcGIS Server (CVSS 6.1)
- [CVE-2023-25840](https://cve.now/CVE-2023-25840.md): BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory (CVSS 3.4)
- [CVE-2023-25837](https://cve.now/CVE-2023-25837.md): BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS. (CVSS 8.4)
- [CVE-2023-25836](https://cve.now/CVE-2023-25836.md): BUG-000135364 XSS in 10.8.1 sites builder iframe source (CVSS 5.4)
- [CVE-2023-25835](https://cve.now/CVE-2023-25835.md): BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability (CVSS 8.4)
- [CVE-2023-25839](https://cve.now/CVE-2023-25839.md): BUG-000157278 – ArcGIS Insights has a security vulnerability - desktop (CVSS 7.0)
- [CVE-2023-25838](https://cve.now/CVE-2023-25838.md): BUG-000157278 – ArcGIS Insights has a security vulnerability. (CVSS 7.5)
- [CVE-2023-25833](https://cve.now/CVE-2023-25833.md): BUG-000155004 HTML injection issue in Portal for ArcGIS. (CVSS 5.4)
- [CVE-2023-25831](https://cve.now/CVE-2023-25831.md): BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS. (CVSS 6.1)
- [CVE-2023-25830](https://cve.now/CVE-2023-25830.md): BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS (CVSS 6.1)
- [CVE-2023-25829](https://cve.now/CVE-2023-25829.md): BUG-000155001 - Unvalidated redirect in Portal for ArcGIS. (CVSS 6.1)
- [CVE-2023-25834](https://cve.now/CVE-2023-25834.md): BUG-000142922 Incomplete permission changes in specific cases. (CVSS 5.4)
- [CVE-2023-25832](https://cve.now/CVE-2023-25832.md): BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS. (CVSS 8.8)
- [CVE-2022-38212](https://cve.now/CVE-2022-38212.md): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (CVSS 7.5)
- [CVE-2022-38211](https://cve.now/CVE-2022-38211.md): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) (CVSS 7.5)
- [CVE-2022-38210](https://cve.now/CVE-2022-38210.md): HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only) (CVSS 6.1)
- [CVE-2022-38209](https://cve.now/CVE-2022-38209.md): Reflected XSS vulnerability in Portal for ArcGIS (CVSS 6.1)
- [CVE-2022-38208](https://cve.now/CVE-2022-38208.md): Unvalidated redirect in Portal for ArcGIS (CVSS 6.1)
- [CVE-2022-38207](https://cve.now/CVE-2022-38207.md): Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (CVSS 6.1)
- [CVE-2022-38206](https://cve.now/CVE-2022-38206.md): Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) (CVSS 6.1)
- [CVE-2022-38205](https://cve.now/CVE-2022-38205.md): Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only) (CVSS 8.6)
- [CVE-2022-38204](https://cve.now/CVE-2022-38204.md): Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (CVSS 6.1)
- [CVE-2022-38203](https://cve.now/CVE-2022-38203.md): The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only) (CVSS 7.5)
- [CVE-2022-38202](https://cve.now/CVE-2022-38202.md): BUG-000152121 - Directory traversal vulnerability in ArcGIS Server. (CVSS 7.5)
- [CVE-2022-38201](https://cve.now/CVE-2022-38201.md): An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. (CVSS 6.1)
- [CVE-2022-38195](https://cve.now/CVE-2022-38195.md): BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server (CVSS 6.1)
- [CVE-2022-38196](https://cve.now/CVE-2022-38196.md): BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability (CVSS 6.5)
- [CVE-2022-38197](https://cve.now/CVE-2022-38197.md): BUG-000148347 Unvalidated redirect issues in ArcGIS Server. (CVSS 6.1)
- [CVE-2022-38198](https://cve.now/CVE-2022-38198.md): BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server (CVSS 6.1)
- [CVE-2022-38199](https://cve.now/CVE-2022-38199.md): BUG-000144172 - Remote file download issue in ArcGIS Server (CVSS 6.1)
- [CVE-2022-38200](https://cve.now/CVE-2022-38200.md): BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. (CVSS 6.1)
- [CVE-2022-38189](https://cve.now/CVE-2022-38189.md): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (CVSS 5.4)
- [CVE-2022-38184](https://cve.now/CVE-2022-38184.md): There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 (CVSS 7.5)
- [CVE-2022-38192](https://cve.now/CVE-2022-38192.md): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (CVSS 6.1)
- [CVE-2022-38193](https://cve.now/CVE-2022-38193.md): Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1) (CVSS 6.1)
- [CVE-2022-38194](https://cve.now/CVE-2022-38194.md): Portal for ArcGIS system properties are not properly encrypted (10.8.1 only) (CVSS 6.7)
- [CVE-2022-38191](https://cve.now/CVE-2022-38191.md): HTML injection vulnerability in Portal for ArcGIS (CVSS 6.1)
- [CVE-2022-38187](https://cve.now/CVE-2022-38187.md): Prevent access to sharing/rest/content/features/analyze to unauthorized users (CVSS 7.5)
- [CVE-2022-38188](https://cve.now/CVE-2022-38188.md): There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user t (CVSS 7.1)
- [CVE-2022-38190](https://cve.now/CVE-2022-38190.md): Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps (CVSS 6.1)
- [CVE-2022-38186](https://cve.now/CVE-2022-38186.md): There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convinc (CVSS 7.1)
- [CVE-2021-29117](https://cve.now/CVE-2021-29117.md): arcreader use-after-free (CVSS 7.8)
- [CVE-2021-29112](https://cve.now/CVE-2021-29112.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3)
- [CVE-2021-29118](https://cve.now/CVE-2021-29118.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3)
- [CVE-2021-29116](https://cve.now/CVE-2021-29116.md): BUG-000142180 Hosted feature services vulnerable to stored XSS (CVSS 6.1)
- [CVE-2021-29115](https://cve.now/CVE-2021-29115.md): An information disclosure vulnerability (CVSS 5.3)
- [CVE-2021-29114](https://cve.now/CVE-2021-29114.md): SQL injection vulnerability in ArcGIS Server (CVSS 7.3)
- [CVE-2021-29113](https://cve.now/CVE-2021-29113.md): Remote file inclusion vulnerability in ArcGIS Server help documentation (CVSS 4.7)
- [CVE-2021-29110](https://cve.now/CVE-2021-29110.md): Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. (CVSS 5.4)
- [CVE-2021-29109](https://cve.now/CVE-2021-29109.md): A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9. (CVSS 6.1)
- [CVE-2021-29108](https://cve.now/CVE-2021-29108.md): There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below. (CVSS 8.8)
- [CVE-2021-29104](https://cve.now/CVE-2021-29104.md): There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. (CVSS 6.1)
- [CVE-2021-29102](https://cve.now/CVE-2021-29102.md): There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below. (CVSS 9.1)
- [CVE-2021-29103](https://cve.now/CVE-2021-29103.md): There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. (CVSS 6.1)
- [CVE-2021-29105](https://cve.now/CVE-2021-29105.md): There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below. (CVSS 5.4)
- [CVE-2021-29106](https://cve.now/CVE-2021-29106.md): There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. (CVSS 4.7)
- [CVE-2021-29107](https://cve.now/CVE-2021-29107.md): There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. (CVSS 6.1)
- [CVE-2021-29099](https://cve.now/CVE-2021-29099.md): There is a SQL injection vulnerability in ArcGIS Server (CVSS 5.3)
- [CVE-2021-29101](https://cve.now/CVE-2021-29101.md): ArcGIS GeoEvent Server has a Directory Traversal security vulnerability. (CVSS 8.6)
- [CVE-2021-29100](https://cve.now/CVE-2021-29100.md): ArcGIS Earth has a File Parsing Directory Traversal Vulnerability (CVSS 7.8)
- [CVE-2021-29098](https://cve.now/CVE-2021-29098.md): ArcGIS general raster security update: uninitialized pointer (CVSS 7.8)
- [CVE-2021-29097](https://cve.now/CVE-2021-29097.md): ArcGIS general raster security update: buffer overflow (CVSS 7.8)
- [CVE-2021-29095](https://cve.now/CVE-2021-29095.md): ArcGIS Server image service and raster analytics security update: uninitialized pointer (CVSS 6.4)
- [CVE-2021-29094](https://cve.now/CVE-2021-29094.md): ArcGIS Server image service and raster analytics security update: buffer overflow (CVSS 6.4)
- [CVE-2021-29093](https://cve.now/CVE-2021-29093.md): ArcGIS Server image service and raster analytics security update: use-after-free (CVSS 6.4)
- [CVE-2021-29096](https://cve.now/CVE-2021-29096.md): ArcGIS general raster security update: use-after-free (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/esri
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.