Skip to content
OpenAdvisories

Vendor

Esri

177 known vulnerabilities.

Products

Portal for ArcGIS 69 ArcGIS Server 64 ArcGIS Enterprise 8 ArcReader 6 Portal for ArcGIS Enterprise Sites 4 ArcGIS Pro 4 Portal for ArcGIS Sites 3 ArcGIS Enterprise Web App Builder 3 ArcGIS Enterprise Server 3 ArcGIS Desktop 3 ArcGIS Engine 3 ArcGIS Desktop Background Geoprocessing 3 ArcGIS Insights 2 ArcGIS Quickcapture 2 Portal for ArcGIS Enterprise Experience Builder 2 Lerc 1 Portal for ArcGIS Enterprise Experience Sites 1 ArcGIS AllSource 1 ArcGIS Monitor 1 ArcGIS GeoEvent Server 1 ArcGIS Earth 1 ArcGIS Web AppBuilder {Developer Edition) 1 ArcGIS Enterprise Builder 1 ArcGIS Engine Background Geoprocessing 1 Enterprise Web App Builder 1 ArcGIS < 2022.1 0 ArcGIS 0 ArcGIS 10.8.1 0 ArcGIS 10.7.1 0 ArcGIS 11 0 ArcGIS 10.9.1 0 ArcGIS 10.9.0 0 ArcGIS < 11.1 0 ArcGIS Enterprise Portal Sites < 11.1 0 ArcGIS Enterprise Server < 11.1 0
All Critical High Medium Low Exploited only Public exploit

127 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-29105

    There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.

    A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.

    Esri ArcGIS Server
  • Medium 4.7
    CVE-2021-29106

    There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.

    A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

    Esri ArcGIS Server
  • Medium 6.1
    CVE-2021-29107

    There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.

    A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

    Esri ArcGIS Server
  • Medium 5.3
    CVE-2021-29099

    There is a SQL injection vulnerability in ArcGIS Server

    A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data…

    Esri ArcGIS Server
  • Medium 6.4
    CVE-2021-29095

    ArcGIS Server image service and raster analytics security update: uninitialized pointer

    Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service acc…

    Esri ArcGIS Server
  • Medium 6.4
    CVE-2021-29094

    ArcGIS Server image service and raster analytics security update: buffer overflow

    Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

    Esri ArcGIS Server
  • Medium 6.4
    CVE-2021-29093

    ArcGIS Server image service and raster analytics security update: use-after-free

    A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

    Esri ArcGIS Server