CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29102 – There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29102
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en ArcGIS Server Manager versión 10.8.1 y por debajo, podría permitir a un atacante remoto, no autenticado falsificar las peticiones GET para URL arbitrarias del sistema, conllevando potencialmente a una enumeración de la red o facilitando otros ataques • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29103 – There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29103
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de tipo Cross Site Scripting (XXS) reflejado en ArcGIS Server Services Directory versión 10.8.1 y por debajo podrían permitir a un atacante remoto convencer a un usuario en hacer clic en un enlace diseñado, el cual podría ejecutar potencialmente ejecutar código arbitrario JavaScript en el navegador del usuario • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29105 – There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29105
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory. Una vulnerabilidad de Cross Site Scripting (XSS) almacenada en el Directorio de Servicios de Esri ArcGIS Server versión 10.8.1 e inferior puede permitir a un atacante remoto autenticado pasar y almacenar cadenas maliciosas en el Directorio de Servicios de ArcGIS • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29106 – There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29106
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de Cross Site Scripting (XSS) reflejada en Esri ArcGIS Server versión 10.8.1 e inferior puede permitir que un atacante remoto pueda convencer a un usuario de que haga clic en un enlace elaborado que podría ejecutar código JavaScript arbitrario en el navegador del usuario • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29099 – There is a SQL injection vulnerability in ArcGIS Server
https://notcve.org/view.php?id=CVE-2021-29099
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue. Se presenta una vulnerabilidad de inyección SQL en algunas configuraciones de ArcGIS Server versiones 10.8.1 y anteriores. Unas peticiones web especialmente diseñadas pueden exponer información que no se tiene previsto divulgar (no conjuntos de datos de clientes). • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-e21-03-server-sql • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •