Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Esri Component: Arcgis Enterprise Clear all filters
TI-2024-16907 CVE-2024-25699 · GHSA-7hfh-vfcv-wfqp

Portal for ArcGIS has an invalid authentication vulnerability

Priority LOW 38

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes,…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00693 Published 2024-04-04 No fix listed CWE-287
TI-2024-16914 CVE-2024-25708 · GHSA-43fc-v55w-5mx4

Persistent XSS when creating new application using Web App Builder

Priority LOW 22

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clic…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00373 Published 2024-04-04 No fix listed CWE-79
TI-2021-10001 CVE-2021-29115 · GHSA-pwfh-3w8f-vww5

Information disclosure in Esri ArcGIS Server

Priority LOW 34

An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02184 Published 2021-12-07 No fix listed CWE-200
TI-2021-02153 CVE-2021-3012 · GHSA-m6pr-qpr2-vp84

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI…

Priority LOW 26

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as one…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00685 Published 2021-04-08 No fix listed CWE-79