Esri ArcGIS Server

CPE Details

Esri ArcGIS Server
esri
arcgis_server
-
2021-12-07
21h56 +00:00
2024-09-30
10h10 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:esri:arcgis_server:-:*:*:*:*:*:*:*

Informations

Vendor

esri

Product

arcgis_server

Version

-

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-38202 2022-12-27 23h00 +00:00 There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).
7.5
Haute
CVE-2022-38195 2022-10-25 16h32 +00:00 There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
6.1
Moyen
CVE-2022-38196 2022-10-25 16h32 +00:00 Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
8.1
Haute
CVE-2022-38197 2022-10-25 16h31 +00:00 Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
6.1
Moyen
CVE-2021-29114 2021-12-07 10h51 +00:00 A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
9.8
Critique
CVE-2021-29099 2021-06-07 11h47 +00:00 A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
5.3
Moyen
CVE-2021-29095 2021-03-25 20h34 +00:00 Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
6.8
Moyen
CVE-2021-29094 2021-03-25 20h33 +00:00 Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
6.8
Moyen
CVE-2021-29093 2021-03-25 20h32 +00:00 A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
6.8
Moyen
CVE-2020-35712 2020-12-25 22h46 +00:00 Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
9.8
Critique
CVE-2014-9741 2015-07-08 15h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-7232 2013-12-30 02h00 +00:00 SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
7.5