Esri Arcgis Server vulnerabilities

CVE-2021-29099 [MEDIUM] CWE-89 CVE-2021-29099: A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and ear A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this iss

CVE-2022-38199 [MEDIUM] CWE-494 CVE-2022-38199: A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the

CVE-2025-67704 [MEDIUM] CWE-79 CVE-2025-67704: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67711 [MEDIUM] CWE-79 CVE-2025-67711: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67708 [MEDIUM] CWE-79 CVE-2025-67708: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67705 [MEDIUM] CWE-79 CVE-2025-67705: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67703 [MEDIUM] CWE-79 CVE-2025-67703: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67709 [MEDIUM] CWE-79 CVE-2025-67709: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2025-67710 [MEDIUM] CWE-79 CVE-2025-67710: There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and L There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVE-2021-29107 [MEDIUM] CWE-79 CVE-2021-29107: A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVE-2021-29104 [MEDIUM] CWE-79 CVE-2021-29104: A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

CVE-2023-25841 [MEDIUM] CWE-79 CVE-2023-25841: There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below o There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Fe

CVE-2022-38198 [MEDIUM] CWE-79 CVE-2022-38198: There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory version There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.

CVE-2021-29115 [MEDIUM] CWE-200 CVE-2021-29115: An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise ve An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.

CVE-2023-25848 [MEDIUM] CWE-319 CVE-2023-25848: ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.

CVE-2024-51958 [MEDIUM] CWE-22 CVE-2024-51958: There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful e There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed

CVE-2024-51966 [MEDIUM] CWE-22 CVE-2024-51966: There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful e There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed

CVE-2021-29116 [MEDIUM] CWE-79 CVE-2021-29116: A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10 A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.

CVE-2022-38195 [MEDIUM] CWE-79 CVE-2022-38195: There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below whi There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.

CVE-2022-38200 [MEDIUM] CWE-79 CVE-2022-38200: A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server vers A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.