CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38206 – Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
https://notcve.org/view.php?id=CVE-2022-38206
29 Dec 2022 — There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser. Hay una vulnerabilidad XSS reflejada en Esri Portal for ArcGIS versiones 10.9.1 e inferiores que puede permitir que un atacante remoto no autenticado cree un enlace manipulado que, al hacer clic, podría ejecutar código JavaScript arbitrario en el navegad... • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38207 – Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
https://notcve.org/view.php?id=CVE-2022-38207
29 Dec 2022 — There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked which could execute arbitrary JavaScript code in the victim’s browser. Hay una vulnerabilidad XSS reflejada en Esri Portal for ArcGIS versiones 10.8.1 y 10.7.1 que puede permitir que un atacante remoto no autenticado cree un enlace manipulado que, al hacer clic, podría ejecutar código JavaScript arbitrario en el nave... • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38208 – Unvalidated redirect in Portal for ArcGIS
https://notcve.org/view.php?id=CVE-2022-38208
29 Dec 2022 — There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Existe una vulnerabilidad de redireccionamiento no validada en Esri Portal para ArcGIS 11 y versiones anteriores que puede permitir que un atacante remoto no autenticado cree una URL que podría redirigir a una víctima a un sitio web arbitrario, simplificando los ataques de phi... • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38209 – Reflected XSS vulnerability in Portal for ArcGIS
https://notcve.org/view.php?id=CVE-2022-38209
29 Dec 2022 — There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser. Hay una vulnerabilidad XSS reflejada en Esri Portal for ArcGIS versiones 10.9.1 y anteriores que puede permitir que un atacante remoto no autenticado cree un enlace manipulado que, al hacer clic en él, podría ejecutar código JavaScript arbitrario en el navegado... • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38210 – HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)
https://notcve.org/view.php?id=CVE-2022-38210
29 Dec 2022 — There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser. Hay una vulnerabilidad de inyección de HTML reflejada en Esri Portal for ArcGIS versiones 10.9.1 y anteriores que puede permitir que un atacante remoto y no autenticado cree un enlace manipulado que, al hacer clic, podría representar HTML arbitrario en el navegad... • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38184 – There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1
https://notcve.org/view.php?id=CVE-2022-38184
16 Aug 2022 — There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs. Se presenta una vulnerabilidad de control de acceso inapropiado en Portal para ArcGIS versiones 10.8.1 y anteriores, que podría permitir a un atacante remoto no autenticado acceder a una API que podría inducir a Esri Portal para ArcGIS a leer URLs arbitrarias. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38192 – There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
https://notcve.org/view.php?id=CVE-2022-38192
16 Aug 2022 — A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de tipo Cross Site Scripting (XSS) almacenado en Esri Portal para ArcGIS puede permitir a un atacante remoto y autenticado pasar y almacenar cadenas maliciosas por medio de consultas diseñadas que, cuando es accedido a ella... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2022-38193 – Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)
https://notcve.org/view.php?id=CVE-2022-38193
16 Aug 2022 — There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution. Existe una vulnerabilidad de inyección de código en Esri Portal for ArcGIS versiones 10.8.1 e inferiores que puede permitir a un atacante remoto no autentificado pasar cadenas que podrían causar la ejecución de código arbitrario • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38191 – HTML injection vulnerability in Portal for ArcGIS
https://notcve.org/view.php?id=CVE-2022-38191
15 Aug 2022 — There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application. Se presenta un problema de inyección de HTML en Esri Portal for ArcGIS versiones 10.9.0 y anteriores, que puede permitir a un atacante remoto y autenticado inyectar HTML en algunas ubicaciones de la aplicación de inicio. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38187 – Prevent access to sharing/rest/content/features/analyze to unauthorized users
https://notcve.org/view.php?id=CVE-2022-38187
15 Aug 2022 — Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs. En versiones anteriores a 10.9.0, el endpoint sharing/rest/content/features/analyze es siempre accesible para usuarios anónimos, lo que podría permitir a un atacante no autenticado inducir a Esri Portal for ArcGIS a leer URLs arbitrarias. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-918: Server-Side Request Forgery (SSRF) •