Unauthorized Access Vulnerability in ArcGIS Server

ArcGIS Server is ESRI released to provide Web-oriented spatial data services for an enterprise-class GIS software platform. An unauthorized access vulnerability exists in ArcGIS Server, which can be exploited by an attacker to obtain sensitive information...

ArcGIS Server Detection (HTTP)

HTTP based detection of ArcGIS Server. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113040";...

ArcGIS Server Remote Command Execution Vulnerability

ArcGIS Server is a Geographic Information System GIS software produced by Esri.ArcGIS Server is used to create and manage GIS Web services, applications, and data. A remote command execution vulnerability exists in ArcGIS Server. An attacker could exploit this vulnerability to cause remote code...

ArcGIS Server 10.3.1: RMIClassLoader RCE

Using an Esri-provided image on Azure's Marketplace, ArcGIS Server 10.3.1 started Java's rmid on port 1098 and explicitly set the property java.rmi.server.useCodebaseOnly equal to false. Screenshot: https://www.dropbox.com/s/xz9ugal3ixnfh1c/10.3.1rmiduseCodebaseOnly%3Dfalse.png?dl=0 As discussed ...

PT-2015-4375 · Esri · Esri Arcgis For Server +2

Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS for Desktop versions 10.2.2 and earlier ESRI ArcGIS for Engine versions 10.2.2 and earlier ESRI ArcGIS for Server versions 10.2.2 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML vi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters...

ESRI ArcGIS for Server - 'where' SQL Injection

source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...

Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...