CVE-2025-4967

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections...

CVE-2025-4967

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections...

CVE-2025-4967

CVE-2025-4967 affects Esri Portal for ArcGIS 11.4 and earlier. A remote, unauthenticated attacker can bypass the portal’s SSRF protections, potentially enabling access to intranet resources. The issue is documented in PT-2025-23199, which recommends updating to the security patch provided in the ...

CVE-2025-4967 Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections...

CVE-2025-4967 Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections...

Esri Portal For ArcGIS 代码问题漏洞

Esri Portal For ArcGis is a core component of ArcGIS Enterprise that is used to share maps, scenes, applications, and geographic information within an organization, enabling centralized management of and access to the content through a web site. A cross-site request forgery vulnerability exists i...

PT-2025-23199

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and prior Description The issue allows a remote, unauthenticated attacker to bypass the Portal’s Server Side Request Forgery SSRF protections. This enables the attacker to potentially exploit the system...

CVE-2022-38201

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

CVE-2021-3012

A cross-site scripting XSS vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror in the URL field of the Parameters tab...

CVE-2020-35712

Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations...

CVE-2014-9741

Multiple cross-site scripting XSS vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-7231

Cross-site scripting XSS vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222...

CVE-2013-7232

SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service...

CVE-2012-1661

ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map .mxd file...

编号撤回

Esri ArcGIS is a powerful desktop GIS software from Esri. This CVE number has been withdrawn...

Esri Portal for ArcGIS Hardcoded Credentials Vulnerability

Esri Portal for ArcGIS is a Web-based geographic information system GIS platform. A hard-coded credentials vulnerability exists in Esri Portal for ArcGIS, which can be exploited by an attacker to gain administrative access to the system...

Esri Portal for ArcGIS < Security 2025 Update 1 Hardcoded Credentials

The version of Esri Portal for ArcGIS installed is missing Security 2025 Update 1. It is, therefore, affected by a hardcoded credentials vulnerability: - A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow ...

CVE-2025-2538

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...

esri.com Cross Site Scripting vulnerability OBB-4035379

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05071)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...