Esri Portal for ArcGIS Elevation of Privilege Vulnerability

Esri Portal for ArcGIS is a Web-oriented, enterprise-class software platform for providing geolocation services from Esri. Esri Portal for ArcGIS 10.9 and earlier versions have an elevation of privilege vulnerability that could be exploited by a remote attacker authenticated to emulate another...

CVE-2021-29108

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account XML Signature Wrapping Attack. In...

CVE-2021-29108

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account XML Signature Wrapping Attack. In...

CVE-2021-29109

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser...

CVE-2021-29110

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

CVE-2021-29110

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

Privilege escalation

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account XML Signature Wrapping Attack. In...

Cross site scripting

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser...

Cross site scripting

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

CVE-2021-29110 Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

CVE-2021-29110 Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.

Stored cross-site scripting XSS issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application...

CVE-2021-29110

The CVE-2021-29110 issue affects Esri Portal for ArcGIS, specifically a stored cross-site scripting (XSS) vulnerability in the home application. An attacker could pass and store malicious strings, with remote unauthenticated access possible; exploitation requires user interaction. The available d...

CVE-2021-29109 A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser...

CVE-2021-29109

CVE-2021-29109 affects Esri Portal for ArcGIS (version 10.9 and earlier). The root cause is a lack of input validation/filtering that enables a reflected cross-site scripting (XSS) when a user clicks a crafted link, potentially allowing arbitrary JavaScript execution in the browser. Public refere...

CVE-2021-29109 A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser...

CVE-2021-29108

The CVE-2021-29108 vulnerability affects Esri Portal for ArcGIS versions 10.9 and earlier. It enables a privileged escalation via an XML Signature Wrapping Attack where a remote, authenticated attacker who can intercept/modify a SAML assertion impersonates another account. The issue is triggered ...

CVE-2021-29108 There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account XML Signature Wrapping Attack. In...

CVE-2021-29108 There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account XML Signature Wrapping Attack. In...

Esri Portal for ArcGIS 跨站脚本漏洞

Esri Portal for ArcGIS is a Web-oriented, enterprise-class software platform for providing geolocation services from Esri, Inc. A cross-site scripting vulnerability exists in Esri Portal for ArcGIS 10.9 and prior versions, which stems from the application's lack of validation of user input and...

Esri Portal For ArcGIS 数据伪造问题漏洞

Esri Portal for ArcGIS is a Web-oriented, enterprise-class software platform for providing geolocation services from Esri. Esri Portal for ArcGIS 10.9 and earlier versions have an elevation of privilege vulnerability that could be exploited by a remote attacker authenticated to emulate another...