CVE-2022-38203

Protections against potential Server-Side Request Forgery SSRF vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeratio...

PT-2022-9908 · Esri · Esri Arcreader

Name of the Vulnerable Software and Affected Versions: Esri ArcReader versions 10.8.1 and earlier Description: An out-of-bounds read issue exists when parsing a specially crafted file, allowing an unauthenticated attacker to induce an information disclosure issue in the context of the current use...

CVE-2021-29103

A reflected Cross Site Scripting XXS vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser...