Esri vulnerabilities
177 CVEs and advisories name Esri as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-25830BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS
- CVE-2023-25829BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.
- CVE-2023-25834BUG-000142922 Incomplete permission changes in specific cases.
- CVE-2023-25832BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.
- CVE-2022-38212Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
- CVE-2022-38211Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
- CVE-2022-38210HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)
- CVE-2022-38209Reflected XSS vulnerability in Portal for ArcGIS
- CVE-2022-38208Unvalidated redirect in Portal for ArcGIS
- CVE-2022-38207Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
- CVE-2022-38206Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
- CVE-2022-38205Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)
- CVE-2022-38204Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
- CVE-2022-38203The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)
- CVE-2022-38202BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.
- CVE-2022-38201An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.
- CVE-2022-38195BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server
- CVE-2022-38196BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability
- CVE-2022-38197BUG-000148347 Unvalidated redirect issues in ArcGIS Server.
- CVE-2022-38198BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server
- CVE-2022-38199BUG-000144172 - Remote file download issue in ArcGIS Server
- CVE-2022-38200BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.
- CVE-2022-38189There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
- CVE-2022-38184There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1
- CVE-2022-38192There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
- CVE-2022-38193Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)
- CVE-2022-38194Portal for ArcGIS system properties are not properly encrypted (10.8.1 only)
- CVE-2022-38191HTML injection vulnerability in Portal for ArcGIS
- CVE-2022-38187Prevent access to sharing/rest/content/features/analyze to unauthorized users
- CVE-2022-38188There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user t