Vulnerabilities in Esri

167 results
Vexday analysis

Com 150 CVEs catalogadas, o portfólio da Esri apresenta uma taxa de exploração ativa abaixo da média geral do catálogo KEV, sem nenhuma vulnerabilidade confirmada em uso por agentes de ameaça no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica exposição persistente a vetores de injeção de scripts em interfaces web. A CVE mais perigosa ativa no momento, CVE-2021-29097, registra um EPSS de 0,0241, sugerindo probabilidade relativamente baixa de exploração em curto prazo, embora as 7 vulnerabilidades de severidade crítica no total mereçam atenção contínua de equipes de gestão de patch. A ausência de PoCs públicas conhecidas reduz a superfície de risco imediato, mas não elimina a necessidade de monitoramento, especialmente diante das 4 CVEs registradas nos últimos 90 dias.

CVE-2024-51958MEDIUMDirectory traversal vulnerability in the admin api for service thumbnailsEPSS 0.6%CVE-2024-51966MEDIUMDirectory traversal vulnerability in ArcGIS ServerEPSS 0.6%CVE-2024-38036MEDIUMBUG-000154827 - Reflected XSS in ArcGIS Experience BuilderEPSS 0.6%CVE-2022-38189MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-38188HIGHThere is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user tEPSS 0.6%CVE-2022-38186HIGHThere is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convincEPSS 0.6%CVE-2022-38198MEDIUMBUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.6%CVE-2022-38192MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-38191MEDIUMHTML injection vulnerability in Portal for ArcGISEPSS 0.6%CVE-2022-38197MEDIUMBUG-000148347 Unvalidated redirect issues in ArcGIS Server.EPSS 0.5%CVE-2025-2538CRITICALBUG-000174336EPSS 0.5%CVE-2023-25831MEDIUMBUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.EPSS 0.5%CVE-2025-57870CRITICALBUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.EPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2023-25830MEDIUMBUG-000154662 Reflected XSS vulnerability in Portal for ArcGISEPSS 0.5%CVE-2024-51962HIGHSQL injection vulnerability in ArcGIS ServerEPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38209MEDIUMReflected XSS vulnerability in Portal for ArcGISEPSS 0.5%CVE-2022-38207MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38206MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%