AS
Product
ArcGIS Server
76
CVEs
0
On KEV
10.0
Max CVSS
6
New 30D
Severity mix
Critical 6High 7Medium 54Low 1
Watch
Add ArcGIS Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51957 | 4.8 | Mar 3 | Stored XSS vulnerability in ArcGIS Rest Services Directory Affected: all through 11.3 |
| CVE-2024-51956 | 4.8 | Mar 3 | Stored XSS vulnerability in ArcGIS Server Administrator Directory Affected: all through 11.3 |
| CVE-2024-51953 | 4.8 | Mar 3 | Stored XSS in ArcGIS Server Rest services Affected: all through 11.3 |
| CVE-2024-51952 | 4.8 | Mar 3 | Stored XSS issue in ArcGIS Server Affected: all through 11.3 |
| CVE-2024-51951 | 4.8 | Mar 3 | Stored XSS in Server Admin API Affected: all through 11.3 |
| CVE-2024-51950 | 4.8 | Mar 3 | Stored XSS in Server Admin under Services > lifecycleinfos Affected: all through 11.3 |
| CVE-2024-51949 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service Affected: all through 11.3 |
| CVE-2024-51948 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under Job ID Affected: all through 11.3 |
| CVE-2024-51947 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under Layer name Affected: all through 11.3 |
| CVE-2024-51946 | 4.8 | Mar 3 | Stored XSS in Rest Services Directory under Identify operation Affected: all through 11.3 |
| CVE-2024-51945 | 4.8 | Mar 3 | Stored XSS issues in Server Admin API Affected: all through 11.3 |
| CVE-2024-51944 | 4.8 | Mar 3 | Stored XSS in Rest Services Directory Affected: all through 11.3 |
| CVE-2024-51942 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page Affected: all through 11.3 |
| CVE-2024-10904 | 4.8 | Mar 3 | Stored XSS in Server Admin API Affected: all through 11.3 |
| CVE-2024-5888 | 4.8 | Mar 3 | Stored XSS in Rest Services API for a Toolbox published as GP Service Affected: all through 11.3 |
| CVE-2021-29113 | 4.7 | Dec 7 | Remote file inclusion vulnerability in ArcGIS Server help documentation Affected: 10.9 through 10.9.0 |
| CVE-2026-2813 | 4.1 | May 20 | Unvalidated Redirect in ArcGIS Server Affected: 11.5 |
| CVE-2023-25840 | 3.4 | Jul 21 | BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory Affected: 10.8.1 before 11.1 |
| CVE-2014-9741 | – | Jul 8 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject… Affected: through 10.2.2 |
| CVE-2014-5122 | – | Aug 22 | Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified… Affected: 10.1.1 |
| CVE-2014-5121 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters Affected: 10.1.1 |
| CVE-2013-7232 | – | Dec 30 | SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service Affected: through 10.2 |
| CVE-2013-7231 | – | Dec 30 | Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or… Affected: 10.1; 10.2 |
| CVE-2013-5222 | – | Dec 30 | Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors Affected: 10.1 |
| CVE-2013-5221 | – | Sep 24 | The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator… Affected: 10.1; 10.2 |
| CVE-2012-4949 | – | Nov 14 | SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service Affected: 10.1 |