CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29095 – ArcGIS Server image service and raster analytics security update: uninitialized pointer
https://notcve.org/view.php?id=CVE-2021-29095
25 Mar 2021 — Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. Múltiples vulnerabilidades de puntero no inicializado cuando se analiza un archivo especialmente diseñado en Esri ArcGIS Server versiones 10.8.1 (y anteriores), permiten a un atacante autenticado con permisos especializados lograr una ejecución de... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image • CWE-824: Access of Uninitialized Pointer •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29094 – ArcGIS Server image service and raster analytics security update: buffer overflow
https://notcve.org/view.php?id=CVE-2021-29094
25 Mar 2021 — Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. Múltiples vulnerabilidades de desbordamiento de búfer cuando se analiza un archivo especialmente diseñado en Esri ArcGIS Server versiones 10.8.1 (y anteriores), permiten a un atacante autenticado con permisos especializados lograr una ejecución de códig... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29093 – ArcGIS Server image service and raster analytics security update: use-after-free
https://notcve.org/view.php?id=CVE-2021-29093
25 Mar 2021 — A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account. Una vulnerabilidad de uso de la memoria previamente liberada cuando se analiza un archivo especialmente diseñado en Esri ArcGIS Server versiones 10.8.1 (y anteriores), permite a un atacante autenticado con permisos especializados lograr una ejecución de código ar... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-35712
https://notcve.org/view.php?id=CVE-2020-35712
25 Dec 2020 — Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Esri ArcGIS Server versiones anteriores a 10.8, es susceptible a una vulnerabilidad de tipo SSRF en algunas configuraciones • https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEyODA2MA== • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2014-9741
https://notcve.org/view.php?id=CVE-2014-9741
08 Jul 2015 — Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en ESRI ArcGIS Desktop, ArcGIS Engine, y ArcGIS Server 10.2.2 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://blogs.esri.com/esri/arcgis/2014/09/04/arcgis-for-server-security-patch-10-1-sp1-qip-10-2-1-10-2-2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5122 – ArcGIS for Server 10.1.1 XSS / Open Redirect
https://notcve.org/view.php?id=CVE-2014-5122
21 Aug 2014 — Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login. Vulnerabilidad de redirreción abierta en ESRI ArcGIS for Server 10.1.1 permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a través de un parámetro no especificado, relacionado con el inicio de sesión. ArcGIS for Server version 10.1.1 suffers from cross ... • http://packetstormsecurity.com/files/127959/ArcGIS-For-Server-10.1.1-XSS-Open-Redirect.html •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5121 – ArcGIS for Server 10.1.1 XSS / Open Redirect
https://notcve.org/view.php?id=CVE-2014-5121
21 Aug 2014 — Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Múltiples vulnerabilidades de XSS en ESRI ArcGIS for Server 10.1.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros no especificados. ArcGIS for Server version 10.1.1 suffers from cross site scripting and open redirect vulnerabilities. • http://packetstormsecurity.com/files/127959/ArcGIS-For-Server-10.1.1-XSS-Open-Redirect.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •