Esri ArcGIS Server 10.9.0

CPE Details

Esri ArcGIS Server 10.9.0
esri
arcgis_server
10.9.0
2021-12-07
14h38 +00:00
2023-08-19
00h38 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:esri:arcgis_server:10.9.0:*:*:*:*:*:*:*

Informations

Vendor

esri

Product

arcgis_server

Version

10.9.0

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-25848 2023-08-25 18h44 +00:00 ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.
5.3
Moyen
CVE-2023-25841 2023-07-21 18h38 +00:00 There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 10.8.1 – 11.0 on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
6.1
Moyen
CVE-2023-25840 2023-07-21 18h37 +00:00 There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.
3.4
Bas
CVE-2022-38202 2022-12-27 23h00 +00:00 There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).
7.5
Haute
CVE-2022-38195 2022-10-25 16h32 +00:00 There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
6.1
Moyen
CVE-2022-38196 2022-10-25 16h32 +00:00 Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
8.1
Haute
CVE-2022-38197 2022-10-25 16h31 +00:00 Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
6.1
Moyen
CVE-2021-29116 2021-12-07 11h00 +00:00 A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
6.1
Moyen
CVE-2021-29114 2021-12-07 10h51 +00:00 A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
9.8
Critique