Vulnerabilities in Esri
177 resultsCVE-2024-38036MEDIUMBUG-000154827 - Reflected XSS in ArcGIS Experience BuilderEPSS 0.6%CVE-2022-38189MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-38197MEDIUMBUG-000148347 Unvalidated redirect issues in ArcGIS Server.EPSS 0.6%CVE-2026-9182CRITICALUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.6%CVE-2024-51958MEDIUMDirectory traversal vulnerability in the admin api for service thumbnailsEPSS 0.6%CVE-2021-29105MEDIUMThere is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.EPSS 0.6%CVE-2022-38186HIGHThere is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convincEPSS 0.6%CVE-2022-38188HIGHThere is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user tEPSS 0.6%CVE-2024-51966MEDIUMDirectory traversal vulnerability in ArcGIS ServerEPSS 0.6%CVE-2022-38191MEDIUMHTML injection vulnerability in Portal for ArcGISEPSS 0.6%CVE-2025-4967CRITICALServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEPSS 0.6%CVE-2022-38192MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2025-2538CRITICALBUG-000174336EPSS 0.6%CVE-2025-57870CRITICALBUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.EPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2023-25831MEDIUMBUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.EPSS 0.5%CVE-2022-38204MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38209MEDIUMReflected XSS vulnerability in Portal for ArcGISEPSS 0.5%CVE-2022-38206MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%