CVE-2022-38187

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2022-38186

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-38186

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

Cross site scripting

A stored Cross Site Scripting XSS vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser...

Design/Logic Flaw

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

Design/Logic Flaw

There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application...

Cross site scripting

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-38191 HTML injection vulnerability in Portal for ArcGIS

There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application...

CVE-2022-38191

CVE-2022-38191 affects Esri Portal for ArcGIS (versions 10.9.0 and earlier) with an HTML injection vulnerability in the home application that requires authentication. Connected sources corroborate HTML injection risk and indicate patches exist (ESRI 2022 Update 1) and advisories noting fixes in A...

CVE-2022-38191 HTML injection vulnerability in Portal for ArcGIS

There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application...

CVE-2022-38187 Prevent access to sharing/rest/content/features/analyze to unauthorized users

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2022-38187 Prevent access to sharing/rest/content/features/analyze to unauthorized users

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2022-38187

The CVE-2022-38187 issue affects Esri Portal for ArcGIS prior to 10.9.0, where the endpoint sharing/rest/content/features/analyze is exposed to anonymous users. This can allow an unauthenticated attacker to cause the portal to read arbitrary URLs. Affected component: Portal for ArcGIS; root cause...

CVE-2022-38188

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-38188

CVE-2022-38188 : A reflected XSS in Esri Portal for ArcGIS 10.9.1 could allow a user to be convinced to click a crafted link, potentially executing arbitrary JavaScript in the browser. It is tied to the Portal component; the underlying issue is a reflected XSS vulnerability. Mitigation: Esri rele...

CVE-2022-38188

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-38190 Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps

A stored Cross Site Scripting XSS vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser...

CVE-2022-38190 Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps

A stored Cross Site Scripting XSS vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser...

CVE-2022-38190

The CVE-2022-38190 issue is a stored XSS in Esri Portal for ArcGIS Configurable Apps. A remote, unauthenticated attacker could inject and store malicious strings via crafted queries, which may execute arbitrary JavaScript in a user’s browser when accessed. No exploitation details are provided in ...

CVE-2022-38186

CVE-2022-38186 is a reflected XSS vulnerability in Esri Portal for ArcGIS, affecting versions prior to or at 10.8.1. A remote attacker could induce a user to click a crafted link, potentially executing arbitrary JavaScript in the victim’s browser. Public references describe impact as browser-base...