CVE-2022-38196

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory...

CVE-2022-38197

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...

Cross site scripting

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

Cross site scripting

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

Path traversal

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory...

Sql injection

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...

Remote file inclusion

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings...

CVE-2022-38195

The CVE-2022-38195 entry describes a reflected XSS vulnerability in Esri ArcGIS Server (versions 10.9.1 and earlier). The issue arises from a vulnerability in handling input that enables an unauthenticated or remote attacker to persuade a user to click a crafted link, which could cause arbitrary ...

CVE-2022-38196

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may allow a remote, authenticated attacker to overwrite internal ArcGIS Server directory, resulting in denial of service. Affected product: ArcGIS Server; vulnerability type: path traversal; impact: integrity/av...

CVE-2022-38197

CVE-2022-38197 affects Esri ArcGIS Server versions 10.9.1 and below, with an unvalidated redirect that could allow a remote, unauthenticated attacker to phish users to an attacker‑controlled site via a crafted query parameter. The issue stems from an unauthenticated redirection vulnerability; pre...

CVE-2022-38198 BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-38198

Esri ArcGIS Server services directory (version 10.9.1 and below) is affected by a reflected cross-site scripting (XSS) vulnerability that could trick a user into clicking a crafted link and potentially execute arbitrary JavaScript in the victim’s browser. The issue is documented across multiple s...

CVE-2022-38199

Summary : CVE-2022-38199 is a remote file download issue in Esri ArcGIS Server web services. An unauthenticated, remote attacker could, in edge cases, induce a victim to launch a process in the victim’s PATH environment. The CVSS v3.1 base score is 6.1 (MEDIUM); attack vector NETWORK, authenticat...

Esri ArcGIS Server 路径遍历漏洞

Esri ArcGIS Server is a web-oriented, enterprise-class software platform for delivering geolocation services from Environmental Systems Research Institute Esri. A path traversal vulnerability exists in Esri ArcGIS Server version 10.9.1 and earlier, which stems from a path traversal issue that cou...

PT-2022-24276 · Esri · Esri Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server affected versions not specified Description: A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services, potentially allowing a remote, unauthenticated attacker to induce an unsuspecting...

PT-2022-24274 · Esri · Esri Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.9.1 and below Description: The issue is related to an unvalidated redirect that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker-controlled website via a crafted query...

Esri ArcGIS Server 跨站脚本漏洞

Esri ArcGIS Server is a web-oriented, enterprise-class software platform for delivering geolocation services from Environmental Systems Research Institute Esri. A cross-site scripting vulnerability exists in Esri ArcGIS Server version 10.9.1 and earlier, which stems from the presence of a...

CVE-2022-38184

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2022-38189

A stored Cross Site Scripting XSS vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser...

Cross site scripting

A stored Cross Site Scripting XSS vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser...