CVE-2024-25698: Improper Neutralization of Input During Web Page Generation

There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the...

CVE-2022-38191: Improper Neutralization of Special Elements in Output Used by a Downstream Component

There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application...

PT-2022-24269 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.0 and below Description: The issue is an HTML injection problem that may allow a remote, authenticated attacker to inject HTML into some locations in the home application. This could potentially be exploit...

CVE-2021-29110: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

Authentication flaw

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...