Vulnerabilities in Esri

167 results
Vexday analysis

Com 150 CVEs catalogadas, o portfólio da Esri apresenta uma taxa de exploração ativa abaixo da média geral do catálogo KEV, sem nenhuma vulnerabilidade confirmada em uso por agentes de ameaça no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica exposição persistente a vetores de injeção de scripts em interfaces web. A CVE mais perigosa ativa no momento, CVE-2021-29097, registra um EPSS de 0,0241, sugerindo probabilidade relativamente baixa de exploração em curto prazo, embora as 7 vulnerabilidades de severidade crítica no total mereçam atenção contínua de equipes de gestão de patch. A ausência de PoCs públicas conhecidas reduz a superfície de risco imediato, mas não elimina a necessidade de monitoramento, especialmente diante das 4 CVEs registradas nos últimos 90 dias.

CVE-2022-38209MEDIUMReflected XSS vulnerability in Portal for ArcGISEPSS 0.5%CVE-2025-4967CRITICALServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEPSS 0.5%CVE-2023-25829MEDIUMBUG-000155001 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.5%CVE-2023-25840LOWBUG-000154070 Stored XSS issue in the ArcGIS REST Services directoryEPSS 0.5%CVE-2022-38208MEDIUMUnvalidated redirect in Portal for ArcGISEPSS 0.5%CVE-2024-38040HIGHBUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerabilityEPSS 0.5%CVE-2024-25690MEDIUMHTML injection in ArcGIS Web AppBuilderEPSS 0.5%CVE-2024-25705MEDIUMCross site scripting issue in embed widgetEPSS 0.5%CVE-2024-25695HIGHconcatenated errors resulting in cross site scripting and frame injection issues.EPSS 0.5%CVE-2024-51961HIGHLocal file inclusion (LFI) vulnerability in ArcGIS ServerEPSS 0.5%CVE-2024-25709MEDIUMSelf-XSS style in move item dialogEPSS 0.4%CVE-2023-25833MEDIUMBUG-000155004 HTML injection issue in Portal for ArcGIS.EPSS 0.4%CVE-2021-29117HIGHarcreader use-after-freeEPSS 0.4%CVE-2023-25836MEDIUMBUG-000135364 XSS in 10.8.1 sites builder iframe sourceEPSS 0.4%CVE-2026-13019CRITICALMissing AuthenticationEPSS 0.4%CVE-2024-25698MEDIUMReflected XSS in Portal for ArcGISEPSS 0.4%CVE-2024-25706MEDIUMHTMLi at createFolder Content InjectionEPSS 0.4%CVE-2025-1726MEDIUM[#BUG-000172669 ArcGIS Monitor has a security vulnerability]EPSS 0.4%CVE-2022-38195MEDIUMBUG-000150540 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.4%CVE-2024-8149MEDIUMBUG-000168624 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.4%