PT-2024-7834

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.1 and 11.2 Description The issue is related to a reflected XSS vulnerability, which may allow a remote, unauthenticated attacker to create a crafted link that, when clicked, could potentially execute arbitrar...

Number withdrawn

Esri ArcGIS Enterprise is a GIS Geographic Information System based software system from Environmental Systems Research Institute Esri, Inc. The system supports mapping and visualization, analysis, and data management. This CVE number has been withdrawn...

PT-2024-7841 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.1 through 11.0 Description: The issue is related to an unvalidated redirect vulnerability that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary...

PT-2024-7825 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.1, 10.8.1 and 10.7.1 Description: The issue is related to a reflected XSS vulnerability. It may allow a remote, unauthenticated attacker to create a crafted link which, when clicked, could potentially...

PT-2024-7827 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.7.1 through 10.9.1 Description: The issue is related to a reflected XSS vulnerability that may allow a remote, unauthenticated attacker to create a crafted link which, when clicked, could potentially execute...

PT-2024-7840 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.1 through 11.2 Description: The issue is related to a local file inclusion vulnerability. It may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive...

Esri Portal For ArcGIS Installed (Windows)

Binary data esriportalforarcgiswininstalled.nbin...

Esri Portal for ArcGIS < Security 2024 Update 1 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed is missing Security 2024 Update 1. It is, therefore, affected by multiple vulnerabilities including: - There is a difficult to exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 10.8.1 through 11.2 on...

Esri Portal for ArcGIS Path Traversal Vulnerability

Esri Portal For ArcGIS is a component of esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A path traversal vulnerability exists in Esri Portal for ArcGIS that stems from the program failing to properly filter for specif...

Esri Portal for ArcGIS Cross-Site Request Forgery Vulnerability

Esri Portal For ArcGIS is an Esri component that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site request forgery vulnerability exists in Esri Portal for ArcGIS, and no detailed vulnerability details are provided at...

CVE-2024-25709

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScrip...

CVE-2024-25708

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25709

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScrip...

CVE-2024-25708

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25706

There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2024-25699

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker...

CVE-2024-25698

There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the...

CVE-2024-25699

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker...