ArcGIS Server Detection (HTTP)

HTTP based detection of ArcGIS Server. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113040";...

ArcGIS Server Remote Command Execution Vulnerability

ArcGIS Server is a Geographic Information System GIS software produced by Esri.ArcGIS Server is used to create and manage GIS Web services, applications, and data. A remote command execution vulnerability exists in ArcGIS Server. An attacker could exploit this vulnerability to cause remote code...

ArcGIS Server 10.3.1: RMIClassLoader RCE

Using an Esri-provided image on Azure's Marketplace, ArcGIS Server 10.3.1 started Java's rmid on port 1098 and explicitly set the property java.rmi.server.useCodebaseOnly equal to false. Screenshot: https://www.dropbox.com/s/xz9ugal3ixnfh1c/10.3.1rmiduseCodebaseOnly%3Dfalse.png?dl=0 As discussed ...

PT-2015-4375 · Esri · Esri Arcgis For Server +2

Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS for Desktop versions 10.2.2 and earlier ESRI ArcGIS for Engine versions 10.2.2 and earlier ESRI ArcGIS for Server versions 10.2.2 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML vi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters...

ESRI ArcGIS for Server - 'where' SQL Injection

source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...

Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...