Esri Arcgis Server vulnerabilities

CVE-2024-51949 [MEDIUM] CWE-79 CVE-2024-51949: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below th There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher c

CVE-2024-51951 [MEDIUM] CWE-79 CVE-2024-51951: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below th There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher c

CVE-2026-2813 [MEDIUM] CWE-601 CVE-2026-2813: ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authentica ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific us

CVE-2014-5122 [MEDIUM] CVE-2014-5122: Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect use Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login.

CVE-2014-5121 [MEDIUM] CWE-79 CVE-2014-5121: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote at Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

CVE-2014-9741 [MEDIUM] CWE-79 CVE-2014-9741: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, a Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-5221 [LOW] CVE-2013-5221: The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated us The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.

CVE-2013-7231 [LOW] CVE-2013-7231: Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.

CVE-2013-5222 [LOW] CWE-79 CVE-2013-5222: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote auth Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2023-25840 [LOW] CWE-79 CVE-2023-25840: There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may a There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.