Vulnerabilities in Esri

154 results
Vexday analysis

Com 150 CVEs catalogadas, o portfólio da Esri apresenta uma taxa de exploração ativa abaixo da média geral do catálogo KEV, sem nenhuma vulnerabilidade confirmada em uso por agentes de ameaça no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica exposição persistente a vetores de injeção de scripts em interfaces web. A CVE mais perigosa ativa no momento, CVE-2021-29097, registra um EPSS de 0,0241, sugerindo probabilidade relativamente baixa de exploração em curto prazo, embora as 7 vulnerabilidades de severidade crítica no total mereçam atenção contínua de equipes de gestão de patch. A ausência de PoCs públicas conhecidas reduz a superfície de risco imediato, mas não elimina a necessidade de monitoramento, especialmente diante das 4 CVEs registradas nos últimos 90 dias.

CVE-2021-29097HIGHArcGIS general raster security update: buffer overflowEPSS 2.4%CVE-2021-29101HIGHArcGIS GeoEvent Server has a Directory Traversal security vulnerability.EPSS 2.3%CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.1%CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2021-29096HIGHArcGIS general raster security update: use-after-freeEPSS 1.5%CVE-2022-38205HIGHPortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)EPSS 1.5%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.3%CVE-2024-25693CRITICALPortal for ArcGIS has a directory traversal vulnerability.EPSS 1.3%CVE-2021-29100HIGHArcGIS Earth has a File Parsing Directory Traversal VulnerabilityEPSS 1.1%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.0%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%CVE-2021-29094MEDIUMArcGIS Server image service and raster analytics security update: buffer overflowEPSS 1.0%CVE-2023-25837HIGHBUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.EPSS 1.0%CVE-2021-29093MEDIUMArcGIS Server image service and raster analytics security update: use-after-freeEPSS 0.9%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 0.9%CVE-2021-29095MEDIUMArcGIS Server image service and raster analytics security update: uninitialized pointerEPSS 0.9%CVE-2022-38184HIGHThere is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1EPSS 0.9%CVE-2022-38211HIGHServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.9%CVE-2023-25835HIGHBUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerabilityEPSS 0.9%