PT-2024-21092 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions prior to 11.3 Description: The issue concerns a path traversal that could allow a remote, authenticated attacker to access files or execute code outside the intended directory. Recommendations: For Esri Portal...

Esri Portal For ArcGIS 授权问题漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. An authorization issue vulnerability exists in Esri Portal For ArcGIS that stems from the presence of incorrect authentication...

PT-2024-21103 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions =11.0 Description: The issue allows a remote, unauthenticated attacker to craft a URL that, when clicked, could generate a message enticing an unsuspecting victim to visit an arbitrary website, simplifying...

Esri Portal For ArcGIS 跨站脚本漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS that stems from vulnerability to cross-site scripting attac...

U.S. Dept Of Defense: SQL injection on ██████████ via 'where' parameter

An SQL injection vulnerability was discovered in the 'where' parameter of the ArcGIS server. The vulnerability allowed an attacker to retrieve database content by injecting malicious SQL queries into the 'where' parameter. Esri released an update to ArcGIS Server 10.1 Service Pack 1 to address th...

PT-2024-7836 · Esri · Esri Portal For Arcgis Enterprise Experience Builder

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Enterprise Experience Builder versions 10.8.1 through 11.1 Description: The issue is related to a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link stored...

PT-2024-7837 · Esri · Esri Portal For Arcgis Enterprise Sites

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Enterprise versions 10.8.1 through 10.9.1 Description: The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link stored in the Layer Showcase...

PT-2024-7831 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 11.1 and below Description: The issue is related to a reflected cross-site scripting problem, where an attacker could potentially execute arbitrary JavaScript code in their own browser. This could be achieved b...

Esri ArcGIS Enterprise Information Disclosure Vulnerability

Esri ArcGIS Enterprise is a suite of GIS Geographic Information System based software from Environmental Systems Research Institute Esri. An information disclosure vulnerability exists in Esri ArcGIS Enterprise that stems from the program's inadequate protection of sensitive information and can b...

Esri ArcGIS Enterprise 信息泄露漏洞

Esri ArcGIS Enterprise is a suite of GIS Geographic Information System based software from Environmental Systems Research Institute Esri. An information disclosure vulnerability exists in Esri ArcGIS Enterprise that stems from the program's inadequate protection of sensitive information and can b...

Esri ArcGIS Enterprise Cross-Site Scripting Vulnerability

Esri ArcGIS Enterprise is esri's set of GIS geographic information system of the basic software system. A cross-site scripting vulnerability exists in Esri ArcGIS Enterprise that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by...

Esri ArcGIS Server Cross-Site Scripting Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server that stems from the application's lack of effective filtering and escaping of user-supplied data; no details of the...

CVE-2023-25841

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2023-25841

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

Cross site scripting

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 10.8.1 – 11.0 on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2023-25841

CVE-2023-25841 describes a stored Cross-site Scripting (XSS) vulnerability in Esri ArcGIS Server. The connected sources confirm affected software as Esri ArcGIS Server versions 10.8.1 through 11.0 on Windows and Linux. The root issue is a lack of proper input filtering/escaping, enabling a remote...

CVE-2023-25837

There is a Cross‑Site Scripting XSS vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser...

CVE-2023-25837

There is a Cross‑Site Scripting XSS vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser...

CVE-2023-25836

There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required...

CVE-2023-25836

There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required...