CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38188
https://notcve.org/view.php?id=CVE-2022-38188
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Se presenta una vulnerabilidad de tipo XSS reflejado en Esri Portal for ArcGIS versiones 10.9.1, que puede permitir a un atacante remoto convencer a un usuario de que haga clic en un enlace diseñado que podría ejecutar código JavaScript arbitrario en el navegador de la víctima. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38190 – Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps
https://notcve.org/view.php?id=CVE-2022-38190
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser Una vulnerabilidad de tipo Cross Site Scripting (XSS) almacenado en las aplicaciones configurables de Esri Portal for ArcGIS puede permitir a un atacante remoto no autenticado pasar y almacenar cadenas maliciosas por medio de consultas diseñadas que, cuando es accedido a ellas, podrían ejecutar código JavaScript arbitrario en el navegador del usuario. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38186
https://notcve.org/view.php?id=CVE-2022-38186
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Se presenta una vulnerabilidad de tipo XSS reflejado en Esri Portal for ArcGIS versiones 10.8.1 y anteriores, que puede permitir a un atacante remoto convencer a un usuario de que haga clic en un enlace diseñado que podría ejecutar código JavaScript arbitrario en el navegador de la víctima. • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29110 – Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
https://notcve.org/view.php?id=CVE-2021-29110
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. Un problema de tipo cross-site scripting (XSS) almacenado en Esri Portal for ArcGIS puede permitir a un atacante remoto no autenticado pasar y almacenar cadenas maliciosas en la aplicación de inicio • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29109 – A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.
https://notcve.org/view.php?id=CVE-2021-29109
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. Una vulnerabilidad de tipo XSS reflejado en Esri Portal for ArcGIS versión 10.9 y por debajo, puede permitir a un atacante remoto convencer a un usuario de que hacer clic en un enlace diseñado que podría ejecutar código JavaScript arbitrario en el navegador del usuario • https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •