AS
Product
ArcGIS Server
75
CVEs
0
On KEV
10.0
Max CVSS
6
New 30D
Severity mix
Critical 6High 7Medium 53Low 1
Watch
Add ArcGIS Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51957 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51956 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51953 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51952 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51951 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51950 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51949 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51948 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51947 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51946 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51945 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51944 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51942 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-10904 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2021-29113 | 4.7 | Dec 7 | A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page Affected: through 10.9.0 |
| CVE-2026-2813 | 4.1 | May 20 | Unvalidated Redirect in ArcGIS Server Affected: 11.5 |
| CVE-2023-25840 | 3.4 | Jul 21 | There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which… Affected: 10.8.1 before 11.1 |
| CVE-2014-9741 | – | Jul 8 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject… Affected: through 10.2.2 |
| CVE-2014-5122 | – | Aug 22 | Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified… Affected: 10.1.1 |
| CVE-2014-5121 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters Affected: 10.1.1 |
| CVE-2013-7232 | – | Dec 30 | SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service Affected: through 10.2 |
| CVE-2013-7231 | – | Dec 30 | Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or… Affected: 10.1; 10.2 |
| CVE-2013-5222 | – | Dec 30 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors Affected: 10.1 |
| CVE-2013-5221 | – | Sep 24 | The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator… Affected: 10.1; 10.2 |
| CVE-2012-4949 | – | Nov 14 | SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service Affected: 10.1 |