Read the docs

Esri

Records195All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high35CVSS 7.0–8.9

Exploited now

Esri records in CISA KEV

No Esri vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Portal For Arcgis 88 records HIGH Arcgis Server 69 records MEDIUM Arcgis Pro 6 records MEDIUM Arcreader 6 records MEDIUM Arcgis Enterprise 5 records LOW Arcmap 4 records MEDIUM Arcgis Engine 3 records MEDIUM Arcgis Allsource 2 records LOW

Records

5 records in Arcgis Enterprise · all components

TI-2024-16907 CVE-2024-25699 · GHSA-7hfh-vfcv-wfqp

Portal for ArcGIS has an invalid authentication vulnerability

Priority LOW 38

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes,…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00693 Published 2024-04-04 No fix listed CWE-287
TI-2021-10001 CVE-2021-29115 · GHSA-pwfh-3w8f-vww5

Information disclosure in Esri ArcGIS Server

Priority LOW 34

An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02184 Published 2021-12-07 No fix listed CWE-200
TI-2021-02153 CVE-2021-3012 · GHSA-m6pr-qpr2-vp84

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI…

Priority LOW 26

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as one…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00685 Published 2021-04-08 No fix listed CWE-79
TI-2024-16914 CVE-2024-25708 · GHSA-43fc-v55w-5mx4

Persistent XSS when creating new application using Web App Builder

Priority LOW 22

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clic…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00373 Published 2024-04-04 No fix listed CWE-79
Open these records in search →