CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38198 – BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server
https://notcve.org/view.php?id=CVE-2022-38198
25 Oct 2022 — There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Se presenta un problema de tipo cross site scripting reflejado en el directorio de servicios de Esri ArcGIS Server versiones 10.9.1 y anteriores, que puede permitir a un atacante remoto no autenticado convencer a u... • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38199 – BUG-000144172 - Remote file download issue in ArcGIS Server
https://notcve.org/view.php?id=CVE-2022-38199
25 Oct 2022 — A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet. Puede producirse un problema de descarga remota de archivos en algunas capacidades de los servicios web de Esri ArcGIS Server que, en algunos casos e... • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-494: Download of Code Without Integrity Check •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38200 – BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.
https://notcve.org/view.php?id=CVE-2022-38200
25 Oct 2022 — A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser. Se presenta una vulnerabilidad de tipo cross site scripting en algunas configuraciones de servicios de mapas de ArcGIS Server versiones 10.8.1 y 10.7.1. Las peticiones web específicamente diseñadas pueden ejecutar JavaScript arbitrario en el contexto del navegador de la víctima • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-map-service-security-2022-update-1-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29116 – BUG-000142180 Hosted feature services vulnerable to stored XSS
https://notcve.org/view.php?id=CVE-2021-29116
07 Dec 2021 — A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de tipo Cross Site Scripting (XSS) almacenada en los servicios de características de Esri ArcGIS Server versiones 10.8.1 y 10.9 (únicamente) puede permitir a u... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29114 – SQL injection vulnerability in ArcGIS Server
https://notcve.org/view.php?id=CVE-2021-29114
07 Dec 2021 — A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries. Una vulnerabilidad de inyección SQL en los servicios de características proporcionados por Esri ArcGIS Server versión 10.9 y anteriores, permite a un atacante remoto no autenticado afectar a la confidencialidad, integridad y disponibilidad de los servicios obje... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29113 – Remote file inclusion vulnerability in ArcGIS Server help documentation
https://notcve.org/view.php?id=CVE-2021-29113
07 Dec 2021 — A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. Una vulnerabilidad de inclusión de archivos remotos en la documentación de ayuda de ArcGIS Server puede permitir a un atacante remoto no autenticado inyectar en una página el html suministrado por el atacante • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29104 – There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29104
11 Jul 2021 — A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. Una vulnerabilidad de tipo Cross Site Scripting (XXS) almacenado en ArcGIS Server Services Directory versión 10.8.1 y por debajo podrían permitir a un atacante remoto no autenticado pasar y almacenar cadenas maliciosas en ArcGIS Services Directory • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29102 – There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29102
11 Jul 2021 — A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en ArcGIS Server Manager versión 10.8.1 y por debajo, podría permitir a un atacante remoto, no autenticado falsificar las peticiones GET para URL arbitrarias del sistema, co... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29103 – There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29103
11 Jul 2021 — A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de tipo Cross Site Scripting (XXS) reflejado en ArcGIS Server Services Directory versión 10.8.1 y por debajo podrían permitir a un atacante remoto convencer a un usuario en hacer clic en un enlace diseñado, el cual podría ejecutar potenci... • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29105 – There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.
https://notcve.org/view.php?id=CVE-2021-29105
11 Jul 2021 — A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory. Una vulnerabilidad de Cross Site Scripting (XSS) almacenada en el Directorio de Servicios de Esri ArcGIS Server versión 10.8.1 e inferior puede permitir a un atacante remoto autenticado pasar y almacenar cadenas maliciosas en el Directorio de Servicios de ArcGIS • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •