PF
Product
Portal for ArcGIS
91
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 16Medium 67Low 0
Watch
Add Portal for ArcGIS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-25832 | 8.8 | May 9 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing… Affected: through 11.0 |
| CVE-2021-29108 | 8.8 | Oct 1 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker… Affected: through 10.9 |
| CVE-2024-25699 | 8.5 | Apr 4 | There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS… Affected: 10.8.1 through 11.2 |
| CVE-2023-25837 | 8.4 | Jul 21 | There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted… Affected: 10.8.1 through 10.9 |
| CVE-2023-25835 | 8.4 | Jul 21 | There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with… Affected: 10.8.1 through 11.1 |
| CVE-2026-69225 | 7.5 | Aug 21 | information disclosure vulnerability in Esri Portal for ArcGIS Affected: 11.5 through 12.0 |
| CVE-2026-69224 | 7.5 | Aug 21 | information disclosure vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 12.0 |
| CVE-2024-38040 | 7.5 | Oct 4 | There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially… Affected: 10.9.1; 11.0; 11.1; 11.2 |
| CVE-2022-38212 | 7.5 | Dec 29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote,… Affected: through 10.8.1 |
| CVE-2022-38211 | 7.5 | Dec 29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote,… Affected: through 10.9.1 |
| CVE-2022-38205 | 7.5 | Dec 29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the… Affected: through 10.9.1 |
| CVE-2022-38203 | 7.5 | Dec 29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote,… Affected: through 10.8.1 |
| CVE-2022-38184 | 7.5 | Aug 16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may… Affected: through 10.8.1 |
| CVE-2022-38187 | 7.5 | Aug 15 | Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri… Affected: before 10.9 |
| CVE-2026-33518 | 7.2 | Apr 21 | Incorrect privilege assignment in Portal for ArcGIS Affected: 11.5 |
| CVE-2024-25695 | 7.2 | Apr 4 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not… Affected: through 11.2 |
Showing 16