CVE-2024-25708

Esri Portal for ArcGIS Enterprise Web App Builder (versions 10.9.1 and below) is affected by a stored Cross-site Scripting vulnerability. The issue allows a remote, authenticated attacker to create a crafted link that, when clicked, could execute arbitrary JavaScript in the victim’s browser. The ...

CVE-2024-25699

The CVE-2024-25699 issue affects Esri Portal for ArcGIS: Home application (versions 11.2 and earlier on Windows/Linux) and ArcGIS Enterprise (11.1 and earlier on Kubernetes). Root cause is an improper authentication flaw that under certain conditions could let a remote, authenticated, low-privile...

CVE-2021-3012

The CVE-2021-3012 entry concerns a cross-site scripting (XSS) vulnerability in Esri ArcGIS Enterprise/Server prior to version 10.9. The flaw arises in the Document Link of documents, where remote authenticated users can inject arbitrary JavaScript by exploiting a malicious HTML attribute (e.g., o...

CVE-2021-29115

CVE-2021-29115 describes an information disclosure in Esri ArcGIS Enterprise (ArcGIS Service Directory) allowing remote viewing of hidden field names in feature layers for ArcGIS Enterprise 10.9.0 and earlier. The vulnerability’s impact is limited to exposing field names; no feature disclosure is...

CVE-2019-16193

CVE-2019-16193 affects ArcGIS Enterprise 10.6.1. A crafted IFRAME can trigger a Cross Frame Scripting (XFS) attack via the EDIT MY PROFILE feature. Public records (NVD) cite CVSS v2 base 3.5 (LOW) and CVSS v3.1 base 5.4 (MEDIUM); attack vector: NETWORK, user interaction required (CVSS3.1), and pa...