Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
74 results · page 2 of 2
Oct 25, 2022Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attaCVE-2022-38196 · Other software · Esri · reported by psirt@esri.comMedium 6.5
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convinceCVE-2022-38195 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unCVE-2021-29116 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to viewCVE-2021-29115 · Other software · Esri · reported by psirt@esri.comMedium 5.3
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidenCVE-2021-29114 · Other software · Esri · reported by psirt@esri.comCritical 9.8
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html intoCVE-2021-29113 · Other software · Esri · reported by psirt@esri.comMedium 4.7
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker toCVE-2021-29105 · Other software · Esri · reported by psirt@esri.comMedium 5.4
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and storCVE-2021-29104 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on aCVE-2021-29103 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET rCVE-2021-29102 · Other software · Esri · reported by psirt@esri.comCritical 9.1
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and storCVE-2021-29107 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to clickCVE-2021-29106 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2021A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier.CVE-2021-29099 · Other software · Esri · reported by psirt@esri.comMedium 5.3
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attackerCVE-2021-29095 · Other software · Esri · reported by psirt@esri.comMedium 6.8
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with CVE-2021-29094 · Other software · Esri · reported by psirt@esri.comMedium 6.8
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specializeCVE-2021-29093 · Other software · Esri · reported by psirt@esri.comMedium 6.8
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.CVE-2020-35712 · Other software · Esri · reported by MITRECritical 9.8
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comsupport.esri.com
Aug 22, 2014Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via aCVE-2014-5122 · Other software · Esri · reported by MITREMedium 5.8
Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Aug 22, 2014Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecifiCVE-2014-5121 · Other software · Esri · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 29, 2013SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map orCVE-2013-7232 · Other software · Esri · reported by MITREHigh 7.5
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comsupport.esri.com
Dec 29, 2013Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrCVE-2013-7231 · Other software · Esri · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comsupport.esri.com
Dec 29, 2013Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via uCVE-2013-5222 · Other software · Esri · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comsupport.esri.com
Sep 24, 2013The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) CVE-2013-5221 · Other software · Esri · reported by MITRELow 3.5
The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comsupport.esri.com
Nov 14, 2012SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for aCVE-2012-4949 · Other software · Esri · reported by cret@cert.orgMedium 6.5
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.
- Product
- Arcgis Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.