CVE-2013-7231

Cross-site scripting XSS vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222...

CVE-2013-7231

CVE-2013-7231 is an XSS vulnerability in ESRI ArcGIS for Server Mobile Content Server (ArcGIS for Server 10.1/10.2). Affected: Mobile Content Server; root cause: unvalidated inputs allowing remote authenticated users to inject script/HTML via unspecified vectors. Impact: potential information lea...

CVE-2013-5222

Multiple cross-site scripting XSS vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-5455 · Esri · Esri Arcgis For Server

Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS for Server version 10.1 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting XSS attacks. Recommendations: For ESRI ArcGIS...

CVE-2013-5221

The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging 1 publisher or 2 administrator privileges...

Unrestricted file upload

The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging 1 publisher or 2 administrator privileges...

CVE-2013-5221

The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging 1 publisher or 2 administrator privileges...

CVE-2013-5221

The CVE-2013-5221 issue affects Esri ArcGIS for Server (versions 10.1–10.2) via the mobile-upload feature. Remote authenticated users who have publisher or administrator privileges can upload executable (.exe) files, representing an unrestricted file upload risk. The reported impact is limited to...

PT-2013-5454 · Esri · Esri Arcgis For Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS for Server versions 10.1 through 10.2 Description: The mobile-upload feature in Esri ArcGIS for Server allows remote authenticated users to upload .exe files by leveraging publisher or administrator privileges. Recommendations: Fo...

CVE-2012-4949

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

Sql injection

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

CVE-2012-4949

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

CVE-2012-4949

CVE-2012-4949 is an SQL injection vulnerability in ESRI ArcGIS 10.1 where the where parameter in a REST service query URI can be exploited by remote authenticated users to execute arbitrary SQL. The root cause is inadequate sanitization of SQL commands in the where clause, enabling a subset of SQ...

ESRI ArcGIS for Server - where SQL Injection

ESRI ArcGIS for Server - where SQL Injection source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

ESRI ArcGIS for Server - 'where' SQL Injection

source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...

Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...

CVE-2012-1661

ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map .mxd file...

Code injection

ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map .mxd file...

EUVD-2012-1671

ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map .mxd file...

CVE-2012-1661

ESRI ArcMap 9 and ArcGIS Desktop 10.0.2.3200 and earlier are affected by a flaw that does not properly prompt before executing embedded VBA macros in map files (.mxd), allowing user‑assisted remote code execution. Root cause: VBA macro execution is not prompting the user. Affected products/versio...